=================================================
Vulnerable Software: AzDGDatingMedium Version 1.9.3
Official Site: http://www.azdg.com/
=================================================
=================================================
Tested:
*php.ini MAGIC_QUOTES_GPC OFF*
Safe mode off
/*
OS: Windows XP SP2 (32 bit)
Apache: 2.2.21.0
PHP Version: 5.2.17.17
MYSQL: 5.5.24
*/
=================================================
Vuln Desc:
AzDGDatingMedium Version 1.9.3
is prone to XSS,CSRF,PHP Code Injection,Directory Traversal,Sql injection vulns.
In fact all this vulns exists in administration section and this a bit mitigates issuses but in other side
using CSRF vuln this is possible to overwrite and silently inject PHP code (Create backdoor)
So this creates risky situation again.
AzDGDatingMedium Version 1.9.3 CSRF WHICH ALLOWS TO CREATE BACKDOOR ON TARGET SITE.
@Print screen after successfull CSRF attack.
http://s009.radikal.ru/i309/1205/d8/9fa47dd133ce.png
Vulnerable code section:(XSS+CSRF+traversal)
=========================SNIP====================
======================EOF main.html============================
=====================BEGIN csrfazdg.html=========================
====================EOF csrfazdg.html============================
Another note:
This CMS stores admin password in plaintext+ in include/config.inc.php
Use this backdoor payload to steal config:
';?>
After succesfull attack open:
http://192.168.0.15/learn/azdgscr/AzDGDatingMedium/languages/zh/zho.php
CTRL+U you will see whole config +admin password included.
You will see something like this: http://s010.radikal.ru/i312/1205/5d/e10c77a25ffd.png
XSS vulns:
Same section is also prone to XSS (Cross Site Scripting Vuln)
A)http://192.168.0.15/learn/azdgscr/AzDGDatingMedium/admin/index.php?do=tedit&c_temp_edit=default&dir=../include/&f=config.inc.php%00
B)http://192.168.0.15/learn/azdgscr/AzDGDatingMedium/admin/index.php?do=tedit&c_temp_edit=default%00&dir=../include/&f=config.inc.php
Note: Use null byte.
SQL injection+CSRF:(In eg: to Create Denial Of Service (DOS) Condition)
(BTW, it is a bit hard to exploit it and obtain something usefull)
============AzDGDatingMedium Version 1.9.3 CSRF+SQL INJECTION exploit========
Vulnerable Code Section:
/admin/index.php
=============BEGIN SNIP==============
case 'mess':
if (!isset($a)) $a='';
if ($a == "s") {
if (!isset($step) || !is_numeric($step)) $step = 50;
if (!isset($from) || !is_numeric($from)) $from = 0;
if(!isset($fromid) || !is_numeric($fromid)) $id='0';
if(!isset($toid) || !is_numeric($toid)) $toid='0';
if(!isset($lastdays) || !is_numeric($lastdays)) $lastdays='0';
$keywords=cb($keywords);
$msortby = " order by id desc";
// Important /////////////
$mid = " id != '0'";
$mfromid = (!empty($fromid)) ? " AND fromid = '".$fromid."'" : "";
$mtoid = (!empty($toid)) ? " AND toid = '".$toid."'" : "";
$mlastdays = (!empty($lastdays)) ? " AND sendtime > DATE_SUB(NOW(), INTERVAL ".$lastdays." DAY)" : "";
$mkeywords = (!empty($keywords)) ? " AND (message LIKE '%".SearchByLike($keywords)."%' OR subject LIKE '".SearchByLike($keywords)."')" : "";
$sql="SELECT * ,".CorrectDate("sendtime")." FROM ".C_MYSQL_MESSAGES." WHERE ".$mid.$mfromid.$mtoid.$mlastdays.$mkeywords.$msortby." limit ".$from.",".$step;
$tsql = "SELECT count(*) as total FROM ".C_MYSQL_MESSAGES." WHERE ".$mid.$mfromid.$mtoid.$mlastdays.$mkeywords;
$result = mysql_query($sql) or die(mysql_error());
$tquery = mysql_query($tsql) or die(mysql_error());
$trows = mysql_fetch_array($tquery);
$count = $trows['total'];
if($count == "0") sprintm($w[110]);
$str=$color='';
include_once C_PATH.'/templates/'.C_TEMP.'/forum/smiles.php';
while ($i = mysql_fetch_array($result)) {
$color = ($color == COLOR4) ? COLOR3 : COLOR4;
$senddate=mysql2data($i['sendtime'], 0, 1);
====================EOF SNIP===============
Final notes:
@2 developers of this script:
Sorry Guys i can't get it to work with MYSQL 5.5.24 and i'm a bit lazy to edit all problematic sql queries.
Thats why i can't pentest it more deeply.
To fix CSRF things realize somethink like this (for $_POST requests)
Same logic also applies to $_GET requests.
=====================BEGIN(i know it is a bit paranoidal like me:)===================
" />
ve POST zapros invoke edildikde funksiyaya by reference oturulme edirsen asagidaki kimi.
Ve her bir skriptin baslangicinda
prepareanticsrf(); funksiyasini cagirirsan.
POST zapros qebul edildikde yoxlayirsan:
csrfcheck($_POST['anticsrftokenize'],$_SESSION['csrftokenize']);
Tokenler uygun olmadiqda xeberdarliq verirem en esasi ise skriptin isini dayandiriram.
/AkaStep
**/
function csrfcheck(&$val1,&$val2)
{
if(!isset($_POST['anticsrftokenize']) || !isset($_SESSION['csrftokenize']) ||!isset($_SESSION['oldbasecsrf']) || md5($_POST['anticsrftokenize'])!==md5($_SESSION['oldbasecsrf']))
{
die('' . refreshsess());
}
}
function refreshsess()
{
echo '';
}
function prepareanticsrf()
{
/* ************************** BEOF ANTI CSRF YOXLANMA UCUN. EL VURMA HECNEYE *******************************************/
if($_SERVER['REQUEST_METHOD']==='GET') // her bir GET requestde yaradiriq.
{
$_SESSION['csrftokenize']=sha1(md5(rand(51389,4895615454).md5(time())));
// # debug echo '' . $_SESSION['csrftokenize'] . ''; kk #
// # debug echo ""; #
/* sessiyani yaradiriq. Mehz bunun sayesinde server side yoxlanama edirik CSRF attackdir ya yox?*/
}
//# Eger sehifeye POST or HEAD OR TRACE zapros gonderirse bizi firlatmaq ucun amma yemeyib gedir bu defe de. #
if($_SERVER['REQUEST_METHOD']!=='GET' && !isset($_SESSION['csrftokenize'])) die(refreshsess());
// Burda header() de vermek olardi amma o halda HEAD requestde infinitive loopa duse bilerdik.
if($_SERVER['REQUEST_METHOD']==='POST' && isset($_SESSION['csrftokenize']))
//Mehz burada biz POST req-ler ucun CSRF token yaradiriq.CSRF tokenleri daha sensitive edirik.
{
$_SESSION['oldbasecsrf']=$_SESSION['csrftokenize'];
$_SESSION['csrftokenize']=sha1(md5(rand(51389,4895615454).md5(time())));
}
if(count($_SESSION) !==0) $_SESSION=array_map('htmlentities',$_SESSION); // Her ehtimal ucun sanitizasiya edek.
/* ************************** EOF ANTI CSRF YOXLANMA UCUN EL VURMA HECNEYE *******************************************/
}
?>
=================================EOF==================================================================
Workaround about XSS vulns:
Include it in your config.inc.php (not tested with this CMS)
====================BEGIN================
','','%0d%0a',
'document.write',',','String.fromCharCode','..','document.cookie','cookie','eval','href','document.location','location.replace','window',
'onmouse','onblur','onfocus','onerror','\'','limit','javascript');
foreach($commonpatterns as $myvals)
{
if(stristr(urldecode($_SERVER['QUERY_STRING']),$myvals))
{
die(''. PHP_EOL .
'Can\'t Proceed your request! It is malicious.
');
}
}
unset($myvals);
?>
============================END===================================
Vendor informed about vulns via e-mail. (Sat, 26 May 2012 02:46:17 +0500)
Note: May be other versions affected but not tested.
+++++++++As always My Special Thanks to:+++++++
packetstormsecurity.org
packetstormsecurity.com
packetstormsecurity.net
securityfocus.com
cxsecurity.com
security.nnov.ru
securtiyvulns.com
securitylab.ru
1337day.com
secunia.com &&
to all AA Team + to all Azerbaijan Black HatZ;)
++++++++++++++++++++++++++++++++++++++++++++++++
Thank you.
Life is Short :(...Try to Enjoy.
/AkaStep ^_^