BF, XSS, IAA and CSRF vulnerabilities in poMMo

["MustLive" <mustlive () websecurity com ua>]

Hello list!

I want to warn you about new multiple security vulnerabilities in poMMo.

These are Brute Force, Cross-Site Scripting, Insufficient Anti-automation
and Cross-Site Request Forgery vulnerabilities.

-------------------------
Affected products:
-------------------------

Vulnerable are all versions of poMMo (poMMo Aardvark PR16.1 and previous
versions).

----------
Details:
----------

Brute Force (WASC-11):

http://site/pommo/index.php

XSS (WASC-08):

http://site/pommo/index.php?referer=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E

Insufficient Anti-automation (WASC-21):

In function "Forgot your password" at page http://site/pommo/index.php there
is no reliable protection against automated requests - the text captcha is
using (which can be easily bypassed with using appropriate algorithm, or
it's possible to use value of correct answer in parameter realdeal, which is
making by JS-code). And also there is leakage of admin's email.

CSRF / IAA (WASC-09):

Or it's possible to send request directly to pending.php:

http://site/pommo/user/pending.php?input=a:2:{s:7:%22adminID%22;b:1;s:5:%22Email%22;s:7:%221 () 1 com%22;}

At this page there is no protection against automated requests and CSRF
(captcha). Which allows to automatically send confirmation letters to email
of admin. And also to use this vulnerability for XSS attack
(http://websecurity.com.ua/5315/), which I've informed about earlier.

------------
Timeline:
------------

2011.10.29 - announced at my site.
2011.10.30 - informed developers.
2011.12.13 - disclosed at my site.

I mentioned about these vulnerabilities at my site:
http://websecurity.com.ua/5472/

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/