GetSimple CMS 2.01 / 2.02 Credential Disclosure

Type packetstorm
Reporter Michael Brooks
Modified 2010-11-24T00:00:00


                                            `Researcher: Michael Brooks  
Affecting: GetSimple CMS 2.01 and 2.02  
Vulnerability: Administrative Credentials Disclosure  
Vendor's Homepage:  
download url for 2.01:  
download svn for 2.02(beta): svn checkout  
GetSimple does not use a SQL Database. Instead it uses a system of  
.xml files located here: These  
files are used to maintain application state and organize the  
applications content. The administrators username and password hash  
can be obtained by navigating to the following xml file:  
Passwords are stored using sha1() and a salt is not used by default,  
although a user can configure the application to use one. It is  
trivial to break this hash using John The Ripper or Cain and Able .  
All failed login attempts are put into the following XML file, this  
information can greatly reduce the number of guesses that an attacker  
would have to make in order to break the sha1 hash.  
There are other interesting files such as a clear text API token can  
be obtained:  
The patch is simple, in the ./data/ directory add a .htaccess file  
with that contains "deny from all".