Qool CMS v2.0 RC2 XSRF Add Root Exploit
Title: Qool CMS v2.0 RC2 XSRF Add Root Exploit
Advisory ID: ZSL-2013-5134
Type: Local/Remote
Impact: Cross-Site Scripting
Risk: (3/5)
Release Date: 06.03.2013
Apache 2.4.2 (Win32)
PHP 5.4.4
MySQL 5.5.25a
[2] http://www.exploit-db.com/exploits/24627/
[3] http://packetstormsecurity.com/files/120692
[4] http://www.osvdb.org/show/osvdb/90973
[5] http://xforce.iss.net/xforce/xfdb/82668
[07.03.2013] - Added reference [1], [2] and [3]
[08.03.2013] - Added reference [4]
[10.03.2013] - Added reference [5]
Web: http://www.zeroscience.mk
e-mail: lab@zeroscience.mk
Advisory ID: ZSL-2013-5134
Type: Local/Remote
Impact: Cross-Site Scripting
Risk: (3/5)
Release Date: 06.03.2013
Summary
Qool CMS is a content management system that helps web masters be more productive. Qool has been built with both worlds (web master, web developer) in mind. It is easy to create addons (extensions) for the system but you can really do without them too.Description
Qool CMS allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a logged-in user visits a malicious web site.Vendor
Qool CMS - http://www.qool.grAffected Version
2.0 RC2 (Codename: Sommige)Tested On
Microsoft Windows 7 Ultimate SP1 (EN)Apache 2.4.2 (Win32)
PHP 5.4.4
MySQL 5.5.25a
Vendor Status
N/APoC
qoolcms_xsrf.htmlCredits
Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk>References
[1] http://cxsecurity.com/issue/WLB-2013030053[2] http://www.exploit-db.com/exploits/24627/
[3] http://packetstormsecurity.com/files/120692
[4] http://www.osvdb.org/show/osvdb/90973
[5] http://xforce.iss.net/xforce/xfdb/82668
Changelog
[06.03.2013] - Initial release[07.03.2013] - Added reference [1], [2] and [3]
[08.03.2013] - Added reference [4]
[10.03.2013] - Added reference [5]
Contact
Zero Science LabWeb: http://www.zeroscience.mk
e-mail: lab@zeroscience.mk
