Home / exploits [webapps / 0day] - Cag CMS Version 0.2 <= XSS & Blind
Posted on 05 October 2010
<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Strict//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd'><html xmlns='http://www.w3.org/1999/xhtml'><head><meta http-equiv='Content-Type' content='text/html; charset=utf-8' /><meta http-equiv='Content-Language' content='en' /><title>Cag CMS Version 0.2 <= XSS & Blind SQL Injection Multiple | Inj3ct0r - exploit database : vulnerability : 0day : shellcode</title><meta name='description' content='Cag CMS Version 0.2 <= XSS & Blind SQL Injection Multiple by Shamus in webapps / 0day | Inj3ct0r - exploit database : vulnerability : 0day : shellcode' /><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon' /><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss' /><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></head><body><pre>========================================================= Cag CMS Version 0.2 <= XSS & Blind SQL Injection Multiple ========================================================= Author : Shamus Date : October, 05th 2010 Location : Solo && Jogjakarta, Indonesia Web : http://antijasakom.net/forum Critical Lvl : Medium Impact : Exposure of sensitive information Where : From Remote Tested on : windows Version : Cag Version 0.2 Beta --------------------------------------------------------------------------- Affected software description: ~~~~~~~~~~~~~~~~~~~~~~~~~~ Application : Cag's CMS Version : Cag Version 0.2 Beta Vendor : ten-321 <= http://sourceforge.net/projects/cagcms/ Download : http://sourceforge.net/projects/cagcms/files/cagcms/CAGCMS%200.2/cagcms_02.zip/download Description : PHP/MySQL-based CMS that allows webmasters to control every element of their site design, while still allowing contributors to dynamically and easily create new public pages for their sites, eliminating the complicated template systems of other CMS. -------------------------------------------------------------------------- Vulnerability: ~~~~~~~~~~~~ - Malicious users may inject JavaScript, VBScript, ActiveX, HTML or Flash into a vulnerable application to fool a user in order to gather data from them. An attacker can steal the session cookie and take over the account, impersonating the user. It is also possible to modify the content of the page presented to the user. - Input passed to the "id" parameter in index.php is not properly verified before being used to sql query. This can be exploited thru the web browser and get the hash password from users. - SQL injection is a vulnerability that allows an attacker to alter backend SQL statements by manipulating the user input. An SQL injection occurs when web applications accept user input that is directly placed into a SQL statement and doesn't properly filter out dangerous characters. - An unauthenticated attacker may execute arbitrary SQL/XPath statements on the vulnerable system. This may compromise the integrity of your database and/or expose sensitive information. PoC/Exploit : ~~~~~~~~~~ - For Cross Site Scripting in parameter "index.php?catid" && "index.php?id": [+] * http://www.targetsite.net/index.php?catid=[XSS] * http://www.targetsite.net/index.php?catid=1>'><Script%20%0d%0a>Alert XSS(406115679152)%3B</Script> [+] * http://www.targetsite.net/index.php?id=[XSS] * http://www.targetsite.net/index.php?id=1<script>Alert XSS</script> - For Blind SQL Injection in parameter "click.php?itemid": [+] * http://www.targetsite.net/click.php?itemid=[Valid ID]+[Blind SQL Injection] Dork: ~~~~~ Google : - N/A Solution: ~~~~~ - Your script should filter metacharacters from user input. - Edit the source code to ensure that input is properly verified. - Check detailed information for more information about fixing this vulnerability. Timeline: ~~~~~~~ - 04 - 10 - 2010 bug found - 04 - 10 - 2010 no vendor contacted - 05 - 10 - 2010 advisory release --------------------------------------------------------------------------- # <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-10-05]</pre></body></html>
