ifnuke - Multiple Vulnerabilities

'''
  __  __  ____         _    _ ____  
 |  \/  |/ __ \   /\  | |  | |  _ \ 
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ < 
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/ 

'''

Abysssec Inc Public Advisory
 
 
  Title            :  IfNuke Multiple Remote Vulnerabilities
  Affected Version :  IfNuke 4.0.0
  Discovery        :  www.abysssec.com
  Vendor	   :  http://www.ifsoft.net/default.aspx

  Demo  	   :  http://www.ifsoft.net/default.aspx?portalName=demo
  Download Links   :  http://ifnuke.codeplex.com/		      
		      

  Admin Page       :  http://Example.com/Login.aspx?PortalName=_default
  
 
Description :
===========================================================================================      
  This version of IfNuke have Multiple Valnerabilities : 

        1- arbitrary Upload file
	2- Persistent XSS



arbitrary Upload file
===========================================================================================     

  using this vulnerability you can upload any file with this two ways:
  
  1- http://Example.com/Modules/PreDefinition/PhotoUpload.aspx?AlbumId=1   (the value of AlbumId is necessary)
        
     your files will be in this path:
           http://Example.com/Users/Albums/

     with this format (for example):
           Shell.aspx ---> img_634150553723437500.aspx

That 634150553723437500 value is DateTime.Now.Ticks.ToString() and will be built in this file :

           http://Example.com/Modules/PreDefinition/PhotoUpload.ascx.cs           
           Ln 102 : fileName = "img_" + DateTime.Now.Ticks.ToString() + "." + GetFileExt(userPostedFile.FileName);



it's possible to do same thing here : 
        
  2- http://Example.com/modules/PreDefinition/VideoUpload.aspx

   and the same vulnerable code is located here :

           http://Example.com/Modules/PreDefinition/VideoUpload.ascx.cs          
           Ln 39 : string createdTime = DateTime.Now.ToString("yyyyMMddHHmmssffff");
                   string newFileNameWithoutExtension = Path.GetFileNameWithoutExtension(fileName) + "_" + createdTime;
          	   string uploadFilePath = Server.MapPath(VideoHelper.GetVideoUploadDirectory(CurrentUser.Name) + newFileNameWithoutExtension + Path.GetExtension(fileName));


Persistent XSS Vulnerabilities:
===========================================================================================     
   
  In these Modules you can find Persistent XSS that data saves with no sanitization:

  1- Module name    : Article
     Fields         : Title , Description
     Valnerable Code: ...\Modules\PreDefinition\Article.ascx.cs
     ln 106:
            if (S_Title.Text.Trim() != string.Empty)
             {
            	parameters.Add("@Title", S_Title.Text.Trim());
            	parameters.Add("@Description", S_Title.Text.Trim());
            	parameters.Add("@Tags", S_Title.Text.Trim());
             }   

     --------------------------------------------------------------------------------------
    
  2- Module name    : ArticleCategory
     Field          : Name
     Valnerable Code: ...\Modules\PreDefinition\ArticleCategory.ascx.cs
     ln 96:
           entity.Name = ((TextBox)lstSearch.Rows[lstSearch.EditIndex].FindControl("txtCategoryName_E")).Text.Trim();     

     --------------------------------------------------------------------------------------
    
  3- Module name    : HtmlText
     Field          : Text
     Valnerable Code: ...\Modules\PreDefinition\HtmlText.ascx.cs
     ln 66:
           entity.Content = txtContent.Value.Trim().Replace("//",string.Empty);

     --------------------------------------------------------------------------------------
    
  4- Module name    : LeaveMessage
     Fields         : NickName , Content
     Valnerable Code: ...\Modules\PreDefinition\LeaveMessage.ascx.cs
     ln 55:
           entity.NickName = txtNickName.Text.Trim();
           entity.Content = txtContent.Text.Trim();

     --------------------------------------------------------------------------------------
    
  5- Module name    : Link
     Field          : Title
     Valnerable Code: ...\Modules\PreDefinition\Link.ascx.cs
     ln 83:
           entity.Title = ((TextBox)lstSearch.Rows[lstSearch.EditIndex].FindControl("txtTitle_E")).Text.Trim();

     --------------------------------------------------------------------------------------
        
  6- Module name    : Photo
     Field          : Title
     Valnerable Code: ...\Modules\PreDefinition\Photo.ascx.cs
     ln 280:
           entity.Title = txtTitle_E.Text.Trim();
     

===========================================================================================