'[FD] Negin Group CMS - (v) Multiple Web Vulnerabilities'

[prev in list] [next in list] [prev in thread] [next in thread] 

List:       full-disclosure
Subject:    [FD] Negin Group CMS - (v) Multiple Web Vulnerabilities
From:       Vulnerability Lab <research () vulnerability-lab ! com>
Date:       2016-04-25 10:17:01
Message-ID: 571DEE9D.3010009 () vulnerability-lab ! com
[Download RAW message or body]

Document Title:
===============
Negin Group CMS - (v) Multiple Web Vulnerabilities

References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1831

Release Date:
=============
2016-04-25

Vulnerability Laboratory ID (VL-ID):
====================================
1831

Common Vulnerability Scoring System:
====================================
7.1

Product & Service Introduction:
===============================
http://www.NeginGroup.com/

Abstract Advisory Information:
==============================
The vulnerability laboratory core research team discovered multiple web vulnerabilities in the \
official Negin Group content management system.

Vulnerability Disclosure Timeline:
==================================
2016-04-25: Public Disclosure (Vulnerability Laboratory)

Discovery Status:
=================
Published

Affected Product(s):
====================
Negin Group
Product: Content Management System 2016 Q2

Exploitation Technique:
=======================
Remote

Severity Level:
===============
High

Technical Details & Description:
================================
A remote sql-injection web vulnerability has been discovered in the official Negin Group \
content management system 2016 Q2. The vulnerability allows remote attackers and privileged \
user accounts to execute own sql commands to compromise the dbms.

The vulnerability is located in the `v` value of the `view_page_one.php` file GET method \
request. Remote attackers are able  to execute own malicious sql commands via `v` value to \
compromise the web-server or connected database management system.  The issue is a classic \
remote sql injection vulnerability. The request method to execute is GET and the attack vector \
is  located on the application-side of the content management system.

The vulnerable `v` value in the `view_page_one.php` file GET method allows an attacker also to \
inject client-side script code for xss exploitation. The attack vector is non-persistent on the \
client-side and the request method to exploit the issue is GET.

The security risk of the vulnerability is estimated as medium with a cvss (common vulnerability \
scoring system) count of 7.1. Exploitation of the sql injection vulnerability requires no user \
interaction and a low privileged web-application user account. Successful exploitation of the \
remote sql injection results in database management system, web-server and web-application \
compromise.

Request Method(s):
				[+] GET

Vulnerable File(s):
				[+] view_page_one.php

Vulnerable Parameter(s):
				[+] v

Proof of Concept (PoC):
=======================
The remote sql-injection vulnerability can be exploited by remote attackers without privileged \
user account or user interaction. For security demonstration or to reproduce the vulnerability \
follow the provided information and steps below to continue.

Dork(s) : "طراحی و اجرا توسط نگین گروپ | www.NeginGroup.com"

PoC: SQL-Injection Exploitation
http://cms.localhost:8080/view_page_one.php?v=-1'[SQL-INJECTION VULNERABILITY!]--

PoC: XSS Exploitation
http://cms.localhost:8080/view_page_one.php?v=137"><html><h1>[CLIENT-SIDE CROSS SITE SCRIPTING \
VULNERABILITY!] </>

Reference(s):
http://cms.localhost:8080/view_page_one.php

Solution - Fix & Patch:
=======================
The vulnerability can be patched by usage of a prepared statement in the vulnerable \
view_page_one.php file GET method request. Encode and parse the vulnerable `v` value to filter \
malicious injected script codes. Restrict the input and disallow the usage of special chars. \
Escape as far as required the entries and use entities to secure the code-line error.

Security Risk:
==============
The security risk of the remote sql-injection web vulnerability and client-side cross site \
vulnerability are estimated as high. (CVSS 7.1)

Credits & Authors:
==================
Amir - Iranian Exploit Database (www.iedb.ir) \
[http://www.vulnerability-lab.com/show.php?user=IEDB%20Team]

Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. \
Vulnerability Lab disclaims all warranties, either expressed or implied,  including the \
warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its \
suppliers are not liable in any case of damage,  including direct, indirect, incidental, \
consequential loss of business profits or special damages, even if Vulnerability-Lab or its \
suppliers have been advised  of the possibility of such damages. Some states do not allow the \
exclusion or limitation of liability for consequential or incidental damages so the foregoing  \
limitation may not apply. We do not approve or encourage anybody to break any licenses, \
policies, deface websites, hack into databases or trade with stolen data.

Domains:    www.vulnerability-lab.com 		- www.vuln-lab.com 						- www.evolution-sec.com
Contact:    admin@vulnerability-lab.com 	- research@vulnerability-lab.com 				- \
                admin@evolution-sec.com
Section:    magazine.vulnerability-lab.com 	- vulnerability-lab.com/contact.php 				- \
                evolution-sec.com/contact
Social:	    twitter.com/vuln_lab		- facebook.com/VulnerabilityLab 				- \
                youtube.com/user/vulnerability0lab
Feeds:	    vulnerability-lab.com/rss/rss.php 	- vulnerability-lab.com/rss/rss_upcoming.php 			- \
                vulnerability-lab.com/rss/rss_news.php
Programs:   vulnerability-lab.com/submit.php 	- \
vulnerability-lab.com/list-of-bug-bounty-programs.php 	- vulnerability-lab.com/register.php

Any modified copy or reproduction, including partially usages, of this file requires \
authorization from Vulnerability Laboratory. Permission to electronically  redistribute this \
alert in its unmodified form is granted. All other rights, including the use of other media, \
are reserved by Vulnerability-Lab Research Team or  its suppliers. All pictures, texts, \
advisories, source code, videos and other information on this website is trademark of \
vulnerability-lab team & the specific  authors or managers. To record, list, modify, use or \
edit our material contact (admin@ or research@vulnerability-lab.com) to get a ask permission.

				    Copyright  � 2016 | Vulnerability Laboratory - [Evolution Security GmbH]™

-- 
VULNERABILITY LABORATORY - RESEARCH TEAM
SERVICE: www.vulnerability-lab.com
CONTACT: research@vulnerability-lab.com

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

[prev in list] [next in list] [prev in thread] [next in thread] 