[FD] Multiple Issues in concretecmsv9.2.7
# Exploit Title: Multiple Web Flaws in concretecmsv9.2.7 # Date: 4/2024 # Exploit Author: Andrey Stoykov # Version: 9.2.7 # Tested on: Ubuntu 22.04 # Blog: http://msecureltd.blogspot.com Verbose Error Message - Stack Trace: 1. Directly browse to edit profile page 2. Error should come up with verbose stack trace Verbose Error Message - SQL Error: 1. Page Settings > Design > Save Changes 2. Intercept HTTP POST request and place single quote to "pTemplateID" 3. Verbose SQL error message would occur Open Redirect: 1. Login to application 2. Click to "Edit This Page" button 3. Intercept HTTP GET request 4. Enter relevant domain as value for "redirect" parameter Stored XSS: 1. Edit page 2. Add HTML and drag it to the page 3. Add XSS payload "> ___ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
[FD] [KIS-2024-02] Invision Community <= 4.7.15 (store.php) SQL Injection Vulnerability
Invision Community <= 4.7.15 (store.php) SQL Injection Vulnerability
[-] Software Link:
https://invisioncommunity.com
[-] Affected Versions:
All versions from 4.4.0 to 4.7.15.
[-] Vulnerability Description:
The vulnerability is located in the
/applications/nexus/modules/front/store/store.php script.
Specifically, into the
IPS\nexus\modules\front\store\_store::_categoryView() method:
126 /* Apply Filters */
127 if ( isset( \IPS\Request::i()->filter ) and \is_array(
\IPS\Request::i()->filter ) )
128 {
129 $url = $url->setQueryString( 'filter', \IPS\Request::i()->filter );
130 foreach ( \IPS\Request::i()->filter as $filterId => $allowedValues )
131 {
132 $where[] = array( \IPS\Db::i()->findInSet(
"filter{$filterId}.pfm_values", array_map( 'intval', explode( ',',
$allowedValues ) ) ) );
133 $joins[] = array( 'table' => array( 'nexus_package_filters_map',
"filter{$filterId}" ), 'on' => array(
"filter{$filterId}.pfm_package=p_id AND
filter{$filterId}.pfm_filter=?", $filterId ) );
134 }
135 }
User input passed through the "filter" request parameter is not
properly sanitized before being
assigned to the $where and $joins variables (lines 132 and 133), which
are later used to execute
some SQL queries. This can be exploited by unauthenticated attackers
to carry out time-based or
error-based Blind SQL Injection attacks. Subsequently, this might also
be exploited to reset
users' passwords and gain unauthorized access to the AdminCP, in order
to achieve
Remote Code Execution (RCE). Successful exploitation of this
vulnerability requires
the nexus application to be installed and configured with one "Product
Group" at least.
[-] Proof of Concept:
https://karmainsecurity.com/pocs/CVE-2024-30163.php
[-] Solution:
Upgrade to version 4.7.16 or later.
[-] Disclosure Timeline:
[08/01/2024] - Vulnerability details sent to SSD Secure Disclosure
[12/03/2024] - Version 4.7.16 released
[20/03/2024] - CVE identifier requested
[24/03/2024] - CVE identifier assigned
[05/04/2024] - Coordinated public disclosure
[-] CVE Reference:
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2024-30163 to this vulnerability.
[-] Credits:
Vulnerability discovered by Egidio Romano.
[-] Other References:
https://invisioncommunity.com/release-notes/4716-r128/
https://ssd-disclosure.com/ssd-advisory-ip-board-nexus-rce-and-blind-sqli/
[-] Original Advisory:
http://karmainsecurity.com/KIS-2024-02
___
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
[FD] [KIS-2024-03] Invision Community <= 4.7.16 (toolbar.php) Remote Code Execution Vulnerability
-- Invision Community <= 4.7.16 (toolbar.php) Remote Code Execution Vulnerability -- [-] Software Link: https://invisioncommunity.com [-] Affected Versions: Version 4.7.16 and prior versions. [-] Vulnerability Description: The vulnerability is located in the /applications/core/modules/admin/editor/toolbar.php script. Specifically, into the IPS\core\modules\admin\editor\_toolbar::addPlugin() method, which will handle the upload of a ZIP file, trying to extract its content into the /applications/core/interface/ckeditor/ckeditor/plugins/ directory; if the ZIP archive does not include a plugin.js file, then the extracted ZIP content will be recursively deleted from the file system, otherwise it will stay there. This can be exploited to execute arbitrary PHP code by uploading a ZIP archive containing a plugin.js file (which can also be empty) along with a PHP file. Successful exploitation of this vulnerability requires an Administrator account having the "toolbar_manage" permission. [-] Proof of Concept: https://karmainsecurity.com/pocs/CVE-2024-30162.php [-] Solution: No official solution is currently available. [-] Disclosure Timeline: [08/01/2024] - Vulnerability details sent to SSD Secure Disclosure [12/03/2024] - Version 4.7.16 released, but the issue is still not fixed [20/03/2024] - CVE identifier requested [24/03/2024] - CVE identifier assigned [05/04/2024] - Coordinated public disclosure [-] CVE Reference: The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2024-30162 to this vulnerability. [-] Credits: Vulnerability discovered by Egidio Romano. [-] Other References: https://ssd-disclosure.com/ssd-advisory-ip-board-nexus-rce-and-blind-sqli/ [-] Original Advisory: http://karmainsecurity.com/KIS-2024-03 ___ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
