Plesk Small Business Manager 10.2.0 and Site Editor – Multiple Vulnerabilities

• Exploit Database
• 115 阅读

• 作者： David Hoyt
  日期： 2010-10-25
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/15313/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129

  XSS + SQL Injection in Plesk Small Business Manager 10.2 + Site Editor ######################################################################## # Vendor: Plesk Small Business Manager 10.2 + Site Editor # Product Description URL http://www.parallels.com/products/small-business-panel/ # Date: 2010-09-17 # Author : David Hoyt – http://cloudscan.me # Contact : h02332@gmail.com # Home : http://cloudscan.me # Dork : Small Business Manager # Bug : Cross Site Scripting + SQL Injection # Tested on : Plesk Small Business Manager 10.2.0 // Windows 2008 /64/R2 # Disclosure : Uncoordinated ######################################################################## UPDATED OCT-14-2010 NOTE TO PARALLELS TEAM: EXPANDED INFO IN [Parallels #1020740] Security issues PSBP and SiteEditor.     Here are the Audit Reports:     URL Reports for Plesk Small Business Manager 20.2.0 + Site Editor http://xss.cx/examples/plesk-reports/plesk-10.2.0.html http://xss.cx/examples/plesk-reports/plesk-10.2.0-site-editor.html http://xss.cx/examples/plesk-reports/plesk-10.2.0-site-editor.xml     Picture Proofs: http://xss.cx/images/plesk-cover-1.jpg http://xss.cx/images/plesk-small-biz-10.2.0-sqli-2-1.jpg http://xss.cx/images/plesk-site-editor-sqli-1-1.jpg http://xss.cx/images/plesk-small-biz-10.2.0-xss-1-1.jpg http://xss.cx/images/plesk-small-biz-10.2.0-xss-2-1.jpg http://xss.cx/images/plesk-small-biz-10.2.0-xss-5.jpg http://xss.cx/images/plesk-small-biz-10.2.0-xss-6.jpg http://xss.cx/images/plesk-small-biz-10.2.0-xss-7.jpg http://xss.cx/images/plesk-small-biz-10.2.0-xss-8.jpg http://xss.cx/images/plesk-small-biz-10.2.0-xss-9.jpg http://xss.cx/images/plesk-small-biz-10.2.0-xss-11.jpg http://xss.cx/images/plesk-small-biz-10.2.0-xss-12.jpg         Vulnerability Examples: ---------------------------------------- 1. SQL Injection Summary Severity: High Confidence: Certain Host: http://vulnerable.plesk.smb.10.2.0.site:8880 Path: /plesk/client@1/domain@1/hosting/file-manager/create-dir/     Severity: High Confidence: Certain Host: http://vulnerable.plesk.smb.10.2.0.site:8880 Path: /plesk/client@1/domain@1/hosting/file-manager/permissions/             2. Cross-site scripting (reflected) 2.1. http://vulnerable.plesk.smb.10.2.0.site:8880/smb/app/available/id/apscatalog/ [category parameter] 2.2. http://vulnerable.plesk.smb.10.2.0.site:8880/smb/app/available/id/apscatalog/ [category parameter] 2.3. http://vulnerable.plesk.smb.10.2.0.site:8880/smb/app/available/id/apscatalog/ [category parameter] 2.4. http://vulnerable.plesk.smb.10.2.0.site:8880/smb/file/copy [items%5B0%5D parameter] 2.5. http://vulnerable.plesk.smb.10.2.0.site:8880/smb/file/index/type/external/ [folder parameter]     Summary Severity: High Confidence: Certain Host: http://vulnerable.plesk.smb.10.2.0.site:8880 Path: /smb/app/available/id/apscatalog/     Severity: High Confidence: Certain Host: http://vulnerable.plesk.smb.10.2.0.site:8880 Path: /smb/app/available/id/apscatalog/         Severity: High Confidence: Certain Host: http://vulnerable.plesk.smb.10.2.0.site:8880 Path: /smb/file/copy     Severity: High Confidence: Certain Host: http://vulnerable.plesk.smb.10.2.0.site:8880 Path: /smb/file/index/type/external/             DETAILS ON SITE EDITOR:     1. SQL injection     1.1. http://vulnerarable.plesk.smb.10.2.0.site:2006/Wizard/Edit/Html [currentPageId parameter] 1.2. http://vulnerarable.plesk.smb.10.2.0.site:2006/Wizard/Edit/Modules/ImageGallery [filelist cookie] 1.3. http://vulnerarable.plesk.smb.10.2.0.site:2006/Wizard/Edit/Modules/ImageGallery/Image/Edit [PLESKSESSID cookie] 1.4. http://vulnerarable.plesk.smb.10.2.0.site:2006/Wizard/Publish [Referer HTTP header] 1.5. http://vulnerarable.plesk.smb.10.2.0.site:2006/sites/78/78806f0057ebcbb04597bd12795bd6a6/__edit/css/styles.css [colorScheme parameter] 1.6. http://vulnerarable.plesk.smb.10.2.0.site:2006/sites/78/78806f0057ebcbb04597bd12795bd6a6/__edit/images/logo.gif [template parameter] 1.7. http://vulnerarable.plesk.smb.10.2.0.site:2006/sites/78/78806f0057ebcbb04597bd12795bd6a6/__edit/images/xsk_16.jpg [colorScheme parameter]     2. Cross-site scripting (reflected) 2.1. http://vulnerarable.plesk.smb.10.2.0.site:2006/Wizard/Edit/Modules/Image [file parameter] 2.2. http://vulnerarable.plesk.smb.10.2.0.site:2006/Wizard/Edit/Modules/Image [name of an arbitrarily supplied request parameter] 2.3. http://vulnerarable.plesk.smb.10.2.0.site:2006/localizedimage.php [name of an arbitrarily supplied request parameter]             Please see URL http://www.cloudscan.me/2010/09/xss-sql-injection-in-plesk-small.html for the complete Advisory.