Title:
======
IPhone TreasonSMS - HTML Inject & File Include Vulnerability
Date:
=====
2012-04-23
References:
===========
http://www.vulnerability-lab.com/get_content.php?id=154
VL-ID:
=====
154
Introduction:
=============
treasonSMS allows you to send SMS from your desktop computer. It turns your iPhone into a SMS webserver, so you can send
sms and reply to SMS from your computer over wifi. Confirmed working with FF 3.5, Safari and IE8.
(Copy of the Vendor Homepage: http://code.google.com/p/treasonsms/)
Abstract:
=========
Vulnerability-Lab Team discovered multiple remote Web Vulnerabilities on treasonSMS Webserver for IPhone.
Report-Timeline:
================
2011-04-23: Public or Non-Public Disclosure
Status:
========
Published
Exploitation-Technique:
=======================
Remote
Severity:
=========
High
Details:
========
A HTML Inject & a File Include vulnerabilit is detected on TreasonSMS IPhone application. The vulnerability allows an
remote attacker to include malicious persistent script codes on application-side of the iphone. This possible way allows the
attacker also to inject for example webshell scripts to get control of the affected application folder. When the IPhone is
jailbreaked the vulnerability exploitation can also result full controll of the affected IPhone. The Bug is located in the
input fields of the Message Sending & Message Output. An attacker can scan the victim on walkthrough because the ip
of the webserver makes the treasonSMS available to anybody without password.
To exploit somebody on a walkthourgh its only required to scan for the stable ip via wlan and access the panel for exploitation.
Vulnerable Module(s):
[+] Send Messages, Kontakte & List Messages
Affected Version(s):
[+] treasonSMS-1.0.8-src
[+] treasonSMS-1.0.8-deb
Picture(s):
../1.jpg
../treasonSMS-fileload_malware.png
../treasonSMS-mozilla_exploitation.png
../treasonSMS-Safari_exploitation1.png
../treasonSMS-Safari_exploitation2.jpg
Proof of Concept:
=================
The vulnerability can be exploited by remote attackers. For demonstration or reproduce ...
2010-12-28 18:49:22
Wir sind schon los, zuspatkommen macht keinen guten Eindruck.
2011-01-31 17:48:05
+49 176 56253349
2011-02-11 23:16:15
Bin jetzt mit dem Minicar unterwegs zum MT..sonst wird das so spät.