+--------------------------------------------------------------------------------------------------------------------------------+ # Exploit Title : ForkCMS 3.2.5 Multiple Vulnerabilities # Date : 21-02-2012 # Author : Ivano Binetti (http://ivanobinetti.com) # Software link : http://www.fork-cms.com/download # Vendor site : http://www.fork-cms.com/ # Version : 3.2.5 and lower # Tested on : Debian Squeeze (6.0) +--------------------------------------------------------------------------------------------------------------------------------+ +------------------------------------------[Multiple Vulnerabilities by Ivano Binetti]-------------------------------------------+ Summary 1)Introduction 2)Vulnerabilities Description 2.1 CSRF 2.1.1 Delete Admins or Users 2.1.2 Delete Web Pages 2.1.3 Privilege Escalation 2.2 XSS (Reflected) 3)Personal observations +--------------------------------------------------------------------------------------------------------------------------------+ 1)Introduction ForkCMS is a cms with an "intuitive and user friendly interface". 2)Vulnerabilities Description ForkCMS 3.2.5 (and lower) suffers from CSRF and XSS (reflected) vulnerabilities. 2.1 CSRF ForkCMS 3.2.5 is prone to a CSRF Vulnerability which allows an attacker to delete admins/users, delete web pages and do privilege escalation when an authenticated admin browses a web page containing the following html/javascript code. 2.1.1 Delete Admins or Users

CSRF Exploit to delete ADMIN/USER account

Note that the first id which is possible to delete is 2 because id 1 - named "Fork CMS"- is a superuser admin created during installation phase (ForkCMS define this user "GOD-user") . IDs's numeration is incremental. 2.1.2 Delete Web Pages

CSRF Exploit to delete Web Pages

NOte that first id is 405 and IDs's numeration is incremental. 2.1.3 Privilege Escalation ForkCMS uses a poor logic to manage sessions. It uses a parameter (called "form_token" and composed by 32 alphanumeric characters) to manage sessions but suppose that you are a normal (not admin) user which sign in into web management interface from the same machine (pc/notebook/server) and same browser of an administrator: ForkCMS will assign the same "form_token" for both so this logic will allow you to use your "form_token" id to create a new admin with the following code:

CSRF Exploit to add ADMIN account

NOte that this logic is the same if you are two administrators or two normal users. Also note that with little changes to this exploit you can modify any ForkCMS parameters. 2.2 XSS (Reflected) http://127.0.0.1/private/en/blog/settings?token=true&report= http://127.0.0.1/private/en/users/index?token=true&error= 3)Personal observations I think that this is a very nice cms which can become great with some security improvements.