Wolf CMS 0.6.0b – Multiple Vulnerabilities

Exploit Database
118 阅读

作者： High-Tech Bridge SA

日期： 2010-11-25
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/15614/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

Vulnerability ID: HTB22681

Reference: http://www.htbridge.ch/advisory/xsrf_csrf_in_wolf_cms.html

Product: Wolf CMS

Vendor: Wolf CMS team ( http://www.wolfcms.org/ )

Vulnerable Version: 0.6.0b and probably prior versions

Vendor Notification: 09 November 2010

Vulnerability Type: CSRF (Cross-Site Request Forgery)

Status: Fixed by Vendor

Risk level: Low

Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/)

CSRF Vulnerability:

Vulnerability Details:

The vulnerability exists due to failure in the "wolf/app/controllers/UserController.php" script to properly verify the source of HTTP request.

Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.

Attacker can use browser to exploit this vulnerability. The following PoC is available:

</form>

document.main.submit();

</script>

XSS Vulnerability in UserController.php:

Vulnerability Details:

User can execute arbitrary JavaScript code within the vulnerable application.

The vulnerability exists due to failure in the "wolf/app/controllers/UserController.php" script to properly sanitize user-supplied input in "user[name]" variable. Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.

An attacker can use browser to exploit this vulnerability. The following PoC is available:

<input type="hidden" name="user[name]" value='"><script>alert(document.cookie)</script>'>

</form>

document.main.submit();

</script>

XSS Vulnerability in SettingController.php:

Vulnerability Details:

User can execute arbitrary JavaScript code within the vulnerable application.

The vulnerability exists due to failure in the "wolf/app/controllers/SettingController.php" script to properly sanitize user-supplied input in "setting[admin_title]" variable. Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.

An attacker can use browser to exploit this vulnerability. The following PoC is available:

<input type="hidden" name="setting[admin_title]" value='Wolf CMS"><script>alert(document.cookie)</script>'>

</form>

document.main.submit();

</script>

XSS Vulnerability in PageController.php:

Vulnerability Details:

User can execute arbitrary JavaScript code within the vulnerable application.

The vulnerability exists due to failure in the "wolf/app/controllers/PageController.php" script to properly sanitize user-supplied input in "page[description]" variable. Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.

An attacker can use browser to exploit this vulnerability. The following PoC is available:

<input type="hidden" name="page[description]" value='descr"><script>alert(document.cookie)</script>'>

</form>

document.main.submit();

</script>

Solution: Upgrade to the most recent version