发布 2010-11-25 漏洞条目

Wolf CMS 0.6.0b – Multiple Vulnerabilities

Exploit Source

Vulnerability ID: HTB22681

Reference: http://www.htbridge.ch/advisory/xsrf_csrf_in_wolf_cms.html

Product: Wolf CMS

Vendor: Wolf CMS team ( http://www.wolfcms.org/ )

Vulnerable Version: 0.6.0b and probably prior versions

Vendor Notification: 09 November 2010

Vulnerability Type: CSRF (Cross-Site Request Forgery)

Status: Fixed by Vendor

Risk level: Low

Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/)

CSRF Vulnerability:

Vulnerability Details:

The vulnerability exists due to failure in the "wolf/app/controllers/UserController.php" script to properly verify the source of HTTP request.

Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.

Attacker can use browser to exploit this vulnerability. The following PoC is available:

</form>

document.main.submit();

</script>

XSS Vulnerability in UserController.php:

Vulnerability Details:

User can execute arbitrary JavaScript code within the vulnerable application.

The vulnerability exists due to failure in the "wolf/app/controllers/UserController.php" script to properly sanitize user-supplied input in "user[name]" variable. Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.

An attacker can use browser to exploit this vulnerability. The following PoC is available:

<input type="hidden" name="user[name]" value='"><script>alert(document.cookie)</script>'>

</form>

document.main.submit();

</script>

XSS Vulnerability in SettingController.php:

Vulnerability Details:

User can execute arbitrary JavaScript code within the vulnerable application.

The vulnerability exists due to failure in the "wolf/app/controllers/SettingController.php" script to properly sanitize user-supplied input in "setting[admin_title]" variable. Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.

An attacker can use browser to exploit this vulnerability. The following PoC is available:

<input type="hidden" name="setting[admin_title]" value='Wolf CMS"><script>alert(document.cookie)</script>'>

</form>

document.main.submit();

</script>

XSS Vulnerability in PageController.php:

Vulnerability Details:

User can execute arbitrary JavaScript code within the vulnerable application.

The vulnerability exists due to failure in the "wolf/app/controllers/PageController.php" script to properly sanitize user-supplied input in "page[description]" variable. Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.

An attacker can use browser to exploit this vulnerability. The following PoC is available:

<input type="hidden" name="page[description]" value='descr"><script>alert(document.cookie)</script>'>

</form>

document.main.submit();

</script>

Solution: Upgrade to the most recent version

作者: High-Tech Bridge SA
日期: 2010-11-25
类别: webapps
平台: php

相关漏洞条目

Prodigy Commerce 3.3.0 – Local File Inclusion

Langflow 1.3.0 – Remote Code Execution

Quick Playground for WordPress 1.3.1 – Unauthenticated Remote Code Execution

MikroORM 7.0.13 – SQL Injection