[Full-disclosure] RCE and CSRF vulnerabilities in CMS WebManager-Pro

["MustLive" <mustlive@xxxxxxxxxxxxxxxxxx>]

Hello list!

I want to warn you about Remote Code Execution and Cross-Site Request
Forgery vulnerabilities in CMS WebManager-Pro. This CMS is widely using at
different web sites, including security and government sites.

-------------------------
Affected products:
-------------------------

Vulnerable are CMS WebManager-Pro v.7.4.3 (version from FGS_Studio) and
previous versions.

----------
Details:
----------

RCE (Remote PHP Code Execution) (WASC-31):

There is possible inclusion of php tags directly in textual fields of
content in the system. Thus at any page (in field "Text") it's possible to
put php code, which will execute at visiting of a page. The attack can be
conducted at access to admin panel, or at CSRF attack on admin.

PHP code is setting in the next way:

<?php include "/etc/passwd"; php?>
<?php include "script.php"; php?>

CSRF (WASC-09):

In edit_content.php there is not checking source of request, which allows to
conduct CSRF attacks for changing of content of any site's page. Which also
can be used for conducting of persistent XSS attacks and for remote code
execution.

------------
Timeline:
------------

2010.11.19 - announced at my site.
2010.11.21 - informed developers.
2011.01.29 - disclosed at my site.

I mentioned about these vulnerabilities at my site
(http://websecurity.com.ua/4696/).

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/