Author: Simo Ben youssef
Contact: Simo_at_Morxploit_com
Discovered: 02 November 2014
Updated: 9 December 2014
Published: 9 December 2014
MorXploit Research
http://www.MorXploit.com
Vendor: Concrete5
Vendor url: www.concrete5.org
Software: Concrete5 CMS
Versions: 5.7.2 and 5.7.2.1 (probably older)
Status: Unpatched
Vulnerable scripts:
single_pages/dashboard/users/
tools/dashboard/sitemap_drag_
Original document: http://morxploit.com/
About Concrete5 (from Wikipedia):
Concrete5 is an open source content management system (CMS) for publishing content on the World Wide Web and intranets.
Concrete5 was designed for ease of use, for users with a minimum of technical skills. It enables users to edit site content directly from the page. It provides version management for every page, similar to wiki software, another type of web site development software. concrete5 allows users to edit images through an embedded editor on the page.
To learn more please visit:
http://en.wikipedia.org/wiki/
http://www.concrete5.org/
Description:
Concrete5 is vulnerable to Cross-Site Scripting, both bulkupdate.php and sitemap_drag_request.php scripts fail to properly sanitize user-supplied input.
PoC Exploit:
bulkupdate.php XSS is exploitable through $_REQUEST['gName']
Using HTTP GET Method:
http://target/index.php/
Using HTTP POST Method:
POST http://target/index.php/
POST DATA:
gName="><script>alert(
sitemap_drag_request.php XSS is triggered through $_REQUEST['instance_id'] but requires a valid ccm_token value which makes it unexploitable (unless the attacker somehow obtains a valid token)
Using HTTP GET Method:
http://target/index.php/tools/
Mitigation:
Validate/Sanitize user supplied-input through $_REQUEST['gName'] and $_REQUEST['instance_id']
Disclosure time-line
02 November 2014: Discovery.
03 November 2014: Initial report sent.
11 November 2014: Second contact.
No response.
09 December 2014: Public disclosure.
Author disclaimer:
The information contained in this entire document is for educational, demonstration and testing purposes only.
Author cannot be held responsible for any malicious use or damage. Use at your own risk.
Komentarų nėra:
Rašyti komentarą