Practico 13.9 Multiple Vulnerabilities

Title: Practico 13.9 Multiple Vulnerabilities
Advisory ID: ZSL-2013-5160
Type: Local/Remote
Impact: Exposure of System Information, Exposure of Sensitive Information, Manipulation of Data, Cross-Site Scripting, Spoofing
Risk: (3/5)
Release Date: 03.11.2013
Practico is a free CMS software project released under license GNU GPL v2.0 for creating web applications in a completely visual and fast fashion. Without programming knowledge.
Practico suffers from multiple vulnerabilities including Cross-Site Scripting (XSS), SQL Injection (SQLi) and Cross-Site Request Forgery (CSRF/XSRF). The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a logged-in user visits a malicious web site. Input passed via several parameters is not properly sanitized before being returned to the user or used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code and HTML/script code in a user's browser session in context of an affected site.
Practico -
Affected Version
Tested On
Microsoft Windows 7 Ultimate SP1 (EN)
Apache 2.4.2 (Win32)
PHP 5.4.7
MySQL 5.5.25a
Vendor Status
[10.10.2013] Vulnerabilities discovered.
[11.10.2013] Contact with the vendor.
[16.10.2013] Vendor replies asking more details.
[17.10.2013] Sent detailed info to the vendor.
[17.10.2013] Vendor promises patch development.
[01.11.2013] Vendor releases version 13.911 to address these issues.
[03.11.2013] Coordinated public security advisory released.
Vulnerability discovered by Gjoko Krstic - <>
[03.11.2013] - Initial release
[04.11.2013] - Added reference [4] and [5]
[05.11.2013] - Added reference [6], [7], [8], [9] and [10]
[15.11.2013] - Added reference [11], [12] and [13]
Zero Science Lab