false positive ver 3.7.3

[sky]

Let's all have the latest version 3.7.3, let's scan Virustotal and find out that Osclass has Malware!
W32.Malware.Heur
virus.js.qexvmc.1070

[Aficionado]

Apparently a false detection.

[sky]

 False detection ??
This is joke

[_CONEJO]

I's a false positive, ie. not a real virus

[dev101]

One file reported (probably by Qihoo) is oc-admin/themes/modern/appearance/widgets.php, which you can check by yourself and see that it is not containing any malicious code. The other one is in oc-includes reported by Webroot, but the file is not specified in the results.

I can't be bothered with Qihoo's 360 AV, as it is only in Chinese, and Webroot is not free. But, as above explained, they are definitely false positives, probably a file hash collides with a known virus signature.

update: if you perform a separate scan of oc-admin, Qihoo will be scilent, but now Bkav will report a false positive (VEX7CA9.Webshell) on the same widgets.php file. Relax.

[sky]

This too ?

Advisory ID: HTB23287
Product: Osclass
Vendor: https://osclass.org/
Vulnerable Version(s): 3.5.9 and probably prior
Tested Version: 3.5.9
Advisory Publication:  December 21, 2015  [without technical details]
Vendor Notification: December 21, 2015
Vendor Patch: January 25, 2016
Public Disclosure: February 17, 2016
Vulnerability Type: SQL Injection [CWE-89]
Risk Level: High
CVSSv3 Base Score: 7.1 [CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L]
Solution Status: Fixed by Vendor
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ )

-----------------------------------------------------------------------------------------------

Advisory Details:

High-Tech Bridge Security Research Lab discovered a high-risk SQL injection vulnerability in Osclass, a popular web-based software for building customized classifieds marketplace. The vulnerability can be exploited to gain access to potentially sensitive information in the application database and even to compromise the entire website.

The vulnerability exists due to insufficient filtration of user-supplied input data passed via the "itemsPerPage" HTTP GET parameter to "/index.php" PHP script. A remote unauthenticated attacker can modify the original SQL query and execute arbitrary SQL commands in application's database.

A simple PoC code below uses a time-based SQL injection technique to demonstrate existence of the vulnerability. The following HTTP request will make page rendering very slow, if MySQL server uses 5th version:

http://[host]/index.php?page=user&action=pub_profile&id=1&itemsPerPage=1%20PROCEDURE%20analyse%28%28select%20extractvalue%28rand%28%29, concat%280x3a, %28IF%28MID%28version%28%29, 1, 1%29%20LIKE%205, %20BENCHMARK%285000000, SHA1%281%29%29, 1%29%29%29%29%29, 1%29

-----------------------------------------------------------------------------------------------

Solution:

Update to Osclass 3.6.0

More Information:
https://blog.osclass.org/2016/01/25/osclass-3-6-0-ready-to-download/

-----------------------------------------------------------------------------------------------

References:

[1] High-Tech Bridge Advisory HTB23287 - https://www.htbridge.com/advisory/HTB23287 - SQL Injection in Osclass
[2] Osclass - https://osclass.org/ - Osclass is a php script that allows you to quickly create and manage your own free classifieds site.
[3] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types.
[4] ImmuniWeb® - https://www.htbridge.com/immuniweb/ - web security platform by High-Tech Bridge for on-demand and continuous web application security, vulnerability management, monitoring and PCI DSS compliance.
[5] Free SSL/TLS Server test - https://www.htbridge.com/ssl/ - check your SSL implementation for PCI DSS and NIST compliance. Supports all types of protocols.

-----------------------------------------------------------------------------------------------

Disclaimer: The information provided in this Advisory is provided "as is" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References.





https://packetstormsecurity.com/files/135829/Osclass-3.5.9-SQL-Injection.html

[_CONEJO]

not a virus, a vulnerability on an old version, it was already patched. we already talk about it and notify it. not sire what you are trying to do. there are a few more vulnerabilities in older versions, we patched all of them and released updates and new versions, as any other software do

[dev101]

vulnerability != virus

[Aficionado]

Ok, not sure what you try to achieve here ?

What is your point ? That Osclass is full of virus ? Full of security holes ?

Bad mouth Osclsass like your post here:

Also I think that the project is dead. A Conejo can only delete posts or block them. Those that are inconvenient for him. For 5 years Osclass little is developed and Conejo was probably alone in the field of battle. So it ends as soon as the money is important. This entry was probably also block me and I will remove from the forum. What a man of him.

I am disappointed that the weak development Osclass. By six years in the little changed. Since 2011, I have a page advertisements that do not require the development of additional features. Will my website now extended with categories such as: Real Estate, Automotive, Jobs. And I see that plug into these categories do not work and are not corrected. And they paid too much cost would buy them no testing beforehand. I see that on the forum there are many questions and few answers. And that means Osclass no longer growing. I think I give up Osclass because it is not worth wasting time on a continuous fixing bugs. My appeal to the whole team is so. See how developing Wordpress. I have several pages of advertisements and does not have any problems with them. Here there are many. Ps. In my Admin Panel is the info that you want to grant for the development of Osclass. Please make a correction, it is the development of Osclass - Market!

[Aficionado]

not a virus, a vulnerability on an old version, it was already patched. we already talk about it and notify it. not sire what you are trying to do. there are a few more vulnerabilities in older versions, we patched all of them and released updates and new versions, as any other software do

Please lock this topic and change the title.