Seditio CMS 1.7.1 Password Disclosure
Posted on 28 July 2015
[+] Exploit Title: Seditio CMS Multiple Vulnerabilities [+] Google Dork: intext:"Powered by Seditio CMS" [+] Date: 27/7/2015 [+] Exploit Author: Arash Khazaei [+] Vendor Homepage: http://www.seditiocms.com/ [+] Software Link: http://www.seditiocms.com/page.php?id=20&a=dl [+] Version: 1.7.1(Last Version) [+] Tested on: Kali , Windows [+] CVE : N/A =============================== Introduction : 1- a vulnerability in seditio cms reveal Admin Password For Attacker. 2- another Vulnerability in This CMS Is After Admin Logged Out Session Will Be Not Expired . =============================== Reaval Admin Password : POC 1: in seditio CMS If We Login With Remember Feature CMS Make COokies Like This : MTpfOjU4YjU0NDRjZjFiNjI1M2E0MzE3ZmUxMmRhZmY0MTFhNzhiZGEwYTk1Mjc5YjFkNTc2OGViZjVjYTYwODI5ZTc4ZGE5NDRlOGE5MTYwYTBiNmQ0MjhjYjIxM2U4MTM1MjVhNzI2NTBkYWM2N2I4ODg3OTM5NGZmNjI0ZGE0ODJmOl86c3BlY2lhbA== if we decode This base64 Encoded Text We Got This : 1:_:58b5444cf1b6253a4317fe12daff411a78bda0a95279b1d5768ebf5ca60829e78da944e8a9160a0b6d428cb213e813525a72650dac67b88879394ff624da482f:_:special If Look Between 1:_: We Have hashed Password Of Admin In This case Hashed Password Is admin1 . do If Admin Cookie Stealed site Admin Password Can Be Stealed By Attacker If Password Not Strong To Much. ================================================== POC 2: if admin cookie stealed by reason Anything If We Set Base64 Of Admin Password Like this : MTpfOjU4YjU0NDRjZjFiNjI1M2E0MzE3ZmUxMmRhZmY0MTFhNzhiZGEwYTk1Mjc5YjFkNTc2OGViZjVjYTYwODI5ZTc4ZGE5NDRlOGE5MTYwYTBiNmQ0MjhjYjIxM2U4MTM1MjVhNzI2NTBkYWM2N2I4ODg3OTM5NGZmNjI0ZGE0ODJmOl86c3BlY2lhbA== and set it on your self cookie you logged in as admin in site . Session Of Admin After Logged Out Never Will Be Expired . Discovered By : Arash Khazaei .
