SQL Injection and XSS in Motorito Motorito < v2.0 Ni 483
SQL Injection and Cross-Site Scripting in Motorito via unfiltered index.php module variables.
Antecedentes
Motorito is an online marketing tool used to manage website content, create content, decide which news stories appear on the homepage, update the product catalog, manage users, edit the menu, send emails, etc.
Description
The flaw was found in CentOS and the latest version of Motorito with Apache 2.2.3 and PHP 5.1.6. To exploit it, you only need to use version 1.0 of the HTTP protocol to interact with the application; this demonstrates that the variables in the index.php module are not properly filtered.
Business impact
These attacks can lead to public defacement, the leakage of confidential data, and compromise of the database server. They can also target client systems, which could become fully compromised.
Affected systems
Pre-v2.0 Ni 483 motor.
Solución
Update to the next version of Motorito, available on its website (current version in the advisory publication: 2.0 Ni 891).
Calendario de divulgación
References
The information contained within this advisory is supplied 'as-is' with no warranties or guarantees of fitness for use or otherwise. Internet Security Auditors accepts no responsibility for any damage caused by the use or misuse of this information.
Company based in Spain and Colombia, specializing in web application auditing, network security, penetration testing, and compliance implementation and assessment. Our clients include some of the largest finance, telecommunications, insurance, and ICT companies. A vendor-independent provider with in-depth experience since 2001. Our R&D efforts include vulnerability research, collaboration on open security projects, whitepapers, and participation in industry events.
Would you like us to review your product?
Contact usDo you need a security audit?
Tell us about your situation and our team will get in touch with you to provide guidance or schedule a technical call.
Request information
Our offices
Transversal 22 # 98-82, Porta 100 Building, Office 1003
110221 Bogotá (Colombia)