full-disclosure - RCE and CSRF vulnerabilities in CMS WebManager-Pro

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <002801cbc0a4$e4739260$c103fea9@ml>
Date: Sun, 30 Jan 2011 19:40:27 +0200
From: "MustLive" <mustlive@...security.com.ua>
To: <submissions@...ketstormsecurity.org>, <full-disclosure@...ts.grok.org.uk>,
	<bugtraq@...urityfocus.com>
Subject: RCE and CSRF vulnerabilities in CMS WebManager-Pro

Hello list!

I want to warn you about Remote Code Execution and Cross-Site Request
Forgery vulnerabilities in CMS WebManager-Pro. This CMS is widely using at
different web sites, including security and government sites.

-------------------------
Affected products:
-------------------------

Vulnerable are CMS WebManager-Pro v.7.4.3 (version from FGS_Studio) and
previous versions.

----------
Details:
----------

RCE (Remote PHP Code Execution) (WASC-31):

There is possible inclusion of php tags directly in textual fields of
content in the system. Thus at any page (in field "Text") it's possible to
put php code, which will execute at visiting of a page. The attack can be
conducted at access to admin panel, or at CSRF attack on admin.

PHP code is setting in the next way:

<?php include "/etc/passwd"; php?>
<?php include "script.php"; php?>

CSRF (WASC-09):

In edit_content.php there is not checking source of request, which allows to
conduct CSRF attacks for changing of content of any site's page. Which also
can be used for conducting of persistent XSS attacks and for remote code
execution.

------------
Timeline:
------------

2010.11.19 - announced at my site.
2010.11.21 - informed developers.
2011.01.29 - disclosed at my site.

I mentioned about these vulnerabilities at my site
(http://websecurity.com.ua/4696/).

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/