=========================================
Vulnerable Software: Incomedia WebSite X5 Evolution <= 9.0.4.1748 (All versions)
Vendor: www.websitex5.com
Vulns: XSS && Auth Bypass
Software License: Commercial
Dork 1: inurl:imsearch.php
Dork 2: intitle:WebSite X5 Manager inurl:/admin/header.php
=========================================
About Software:
==========================================
WebSite X5 Evolution 9 is the most versatile and complete solution you'll find
for creating eye-catching, functional and professional websites, blogs and
online stores.
You'll be surprised at how easy WebSite X5 Evolution 9 is to use, but what is
perhaps most amazing is the sheer power and totality of the features it offers.
http://www.websitex5.com/en/evolution-9.html
*Nice Software and easy to use.*
==========================================
About Vulnerabilities:
[*] XSS: [*]
site.tld/imsearch.php?search="\>
Fix:
Open imsearch.php and find:
=============VULNERABLE CODE==============
search(@$_GET['search'], @$_GET['page']);
?>
==========END OF VULNERABLE CODE==========
REPLACE WITH:
==============FIXED CODE====================
search(@htmlspecialchars($_GET['search']), htmlspecialchars(@$_GET['page']));
?>
===========END OF FIXED CODE================
[*] Second vulnerability is Authentication Bypass. [*]
Vulnerable code: site.tld/admin/checkaccess.php
========= BEGIN VULNERABLE CODE ===========
checkAccess("admin/" . basename($_SERVER['PHP_SELF'])) !== 0) {
if (basename($_SERVER['HTTP_REFERER']) == "login.php")
header("Location: login.php?error");
else
header("Location: login.php");
}
else
$logged = TRUE;
// End of file checkaccess.php
==========END OF VULNERABLE CODE==========
Notice flaw: Script continues execution.
For reproduce:
===============================================
Using Fiddler intercept the traffic from your browser and you will get output from scripts execution.
Print screen:
http://oi47.tinypic.com/f21sf7.jpg
==================== RAW=======================
HTTP/1.1 302 Found
Date: Sun, 25 Nov 2012 01:13:19 GMT
Server: Apache
Set-Cookie: ASPX=pfsnkn5ccps9u15pa0r4of6lodesg6lq; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Location: login.php
Content-Length: 1188
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html
WebSite X5 Manager
Версия PHP: 5.2.17PASS
Поддержка сессииPASS
Путь к публичной папке на сервереPASS
===============EOF RAW==================
If your checkaccess.php isn't patched every file on /admin/*.php is vulnerable.
Fixed Code:
site.tld/admin/checkaccess.php
==============BEGIN =FIXED CODE=================
checkAccess("admin/" . basename($_SERVER['PHP_SELF'])) !== 0)
{
if (basename($_SERVER['HTTP_REFERER']) == "login.php")
{
header("Location: login.php?error");
exit;
}
else
{
header("Location: login.php");
exit;
}
}
else
{
$logged = TRUE;
}
// End of file checkaccess.php
===============END OF FIXED CODE================
**Vendor notified about this advisory.**
================================================
SHOUTZ+RESPECTS+GREAT THANKS TO ALL MY FRIENDS:
================================================
packetstormsecurity.org
packetstormsecurity.com
packetstormsecurity.net
securityfocus.com
cxsecurity.com
security.nnov.ru
securtiyvulns.com
securitylab.ru
secunia.com
securityhome.eu
exploitsdownload.com
exploit-db.com
osvdb.com
websecurity.com.ua
to all Aa Team + to all Azerbaijan Black HatZ
+ *Especially to my bro CAMOUFL4G3 *
To All Turkish Hackers
Also special thanks to: ottoman38 & HERO_AZE
================================================
/AkaStep