Getsimple CMS 2.01 2.02 - Administrative Credentials Disclosure

Type exploitpack
Reporter Michael Brooks
Modified 2010-11-24T00:00:00


Getsimple CMS 2.01 2.02 - Administrative Credentials Disclosure

                                            Researcher: Michael Brooks
Affecting: GetSimple CMS 2.01 and 2.02
Vulnerability: Administrative Credentials Disclosure
Vendor's Homepage:

download url for 2.01:
download svn for 2.02(beta): svn checkout

GetSimple does not use a SQL Database. Instead it uses a system of
.xml files located here: These
files are used to maintain application state and organize the
applications content. The administrators username and password hash
can be obtained by navigating to the following xml file:
Passwords are stored using sha1() and a salt is not used by default,
although a user can configure the application to use one. It is
trivial to break this hash using John The Ripper or Cain and Able .

All failed login attempts are put into the following XML file, this
information can greatly reduce the number of guesses that an attacker
would have to make in order to break the sha1 hash.

There are other interesting files such as a clear text API token can
be obtained:

The patch is simple, in the ./data/ directory add a .htaccess file
with that contains "deny from all".