164 lines
4 KiB
Text
Executable file
164 lines
4 KiB
Text
Executable file
Title:
|
|
======
|
|
Wolf CMS v0.7.5 - Multiple Web Vulnerabilities
|
|
|
|
|
|
Date:
|
|
=====
|
|
2012-02-27
|
|
|
|
|
|
References:
|
|
===========
|
|
http://www.vulnerability-lab.com/get_content.php?id=452
|
|
|
|
|
|
VL-ID:
|
|
=====
|
|
452
|
|
|
|
|
|
Introduction:
|
|
=============
|
|
Wolf CMS is a content management system and is Free Software published
|
|
under the GNU General
|
|
Public License v3. Wolf CMS is written in the PHP programming language.
|
|
Wolf CMS is a fork of Frog CMS.
|
|
The project was a finalistin the 2010 Packt Publishing s Open Source awards
|
|
for the Most Promising
|
|
Open Source Project category. As of the 28th of December 2010, the Wolf CMS
|
|
code repository was moved
|
|
from Google Code to Github.
|
|
|
|
( Copy of the Vendor Homepage: http://en.wikipedia.org/wiki/Wolf_CMS )
|
|
|
|
|
|
Abstract:
|
|
=========
|
|
Vulnerability Laboratory Research Team discovered multiple Web
|
|
Vulnerabilities on the Wolf Content Management System v0.7.5
|
|
|
|
|
|
Report-Timeline:
|
|
================
|
|
2012-02-11: Vendor Notification
|
|
2012-02-27: Public or Non-Public Disclosure
|
|
|
|
|
|
Status:
|
|
========
|
|
Published
|
|
|
|
|
|
Affected Products:
|
|
==================
|
|
BlueWin CH
|
|
Product: Wolf CMS v0.7.5
|
|
|
|
|
|
Exploitation-Technique:
|
|
=======================
|
|
Remote
|
|
|
|
|
|
Severity:
|
|
=========
|
|
High
|
|
|
|
|
|
Details:
|
|
========
|
|
1.1
|
|
A SQL Injection vulnerability is detected on the Wolfs Content Management
|
|
System v0.7.5. The
|
|
vulnerability allows an remote attacker to execute own sql commands on the
|
|
affected application
|
|
dbms. Successful exploitation can result in dbms, web-server or application
|
|
compromise.
|
|
|
|
Vulnerable Module(s):
|
|
[+] /plugins/comment/[Index]
|
|
|
|
Picture(s):
|
|
../1.png
|
|
|
|
|
|
1.2
|
|
Multiple persistent vulnerabilities are detected on the Wolfs Content
|
|
Management System v0.7.5.
|
|
The bug allows an remote attacker or local low privileged user account to
|
|
inject persistent malicious
|
|
script code on application side. Successful exploitation can result in
|
|
persistent context manipulation
|
|
on requests, session hijacking & account steal via application side
|
|
phishing.
|
|
|
|
Vulnerable Module(s):
|
|
[+] /plugins/comment/
|
|
|
|
|
|
|
|
Picture(s):
|
|
../2.png
|
|
|
|
|
|
Proof of Concept:
|
|
=================
|
|
The vulnerabilities can be exploited by remote attackers & local low
|
|
privileged user accounts with- and
|
|
without required user inter action. For demonstration or reproduce ...
|
|
|
|
1.1
|
|
Path: /wolfcms/wolf/plugins/comment/
|
|
File: index.php
|
|
|
|
Review:
|
|
271: $ip = isset($_SERVER['HTTP_X_FORWARDED_FOR']) ?
|
|
$_SERVER['HTTP_X_FORWARDED_FOR']:($_SERVER['REMOTE_ADDR']);
|
|
|
|
|
|
1.2
|
|
Path: /wolfcms/wolf/plugins/comment/
|
|
File: index.php
|
|
|
|
Review:
|
|
/wolfcms/wolf/plugins/comment/index.php
|
|
272: echo '<input type="hidden" value="'.$ip.'" name="comment[author_ip]"
|
|
/>';
|
|
|
|
|
|
Risk:
|
|
=====
|
|
1.1
|
|
The security risk of the blind sql injection vulnerabilities are estimated
|
|
as high(+).
|
|
|
|
1.2
|
|
The security risk of the persistant xss vulnerabilities are estimated as
|
|
medium(+).
|
|
|
|
|
|
Credits:
|
|
========
|
|
Vulnerability Research Laboratory - Ucha Gobejishvili (longrifle0x)
|
|
|
|
|
|
Disclaimer:
|
|
===========
|
|
The information provided in this advisory is provided as it is without any
|
|
warranty. Vulnerability-Lab disclaims all warranties,
|
|
either expressed or implied, including the warranties of merchantability
|
|
and capability for a particular purpose. Vulnerability-
|
|
Lab or its suppliers are not liable in any case of damage, including
|
|
direct, indirect, incidental, consequential loss of business
|
|
profits or special damages, even if Vulnerability-Lab or its suppliers have
|
|
been advised of the possibility of such damages. Some
|
|
states do not allow the exclusion or limitation of liability for
|
|
consequential or incidental damages so the foregoing limitation
|
|
may not apply. Any modified copy or reproduction, including partially
|
|
usages, of this file requires authorization from Vulnerability-
|
|
Lab. Permission to electronically redistribute this alert in its unmodified
|
|
form is granted. All other rights, including the use of
|
|
other media, are reserved by Vulnerability-Lab or its suppliers.
|
|
|
|
Copyright ? 2012|Vulnerability-Lab
|