SUBRION CMS multiple vulnerabilities

vendor:

Subrion CMS

by:

Karthik R (3psil0nLambDa)

5.5

CVSS

MEDIUM

SQL Injection, Persistent XSS

79, 89

CWE

Product Name: Subrion CMS

Affected Version From: Unknown

Affected Version To: Unknown

Patch Exists: Unknown

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested: Unknown

Unknown

SUBRION CMS multiple vulnerabilities

There are multiple vulnerabilities in Subrion CMS. The first vulnerability allows attackers to bypass authentication and gain access to the admin panel using a specific username and password. The second vulnerability is a persistent XSS vulnerability in the title field of the Poll module and Manage pages. Attackers can inject malicious code into the title field, which will be executed when the page is viewed by other users. Additionally, other products like Auto Classifieds, Articles Script, Real estate script, and Web directory that run on the same CMS are also vulnerable.

Mitigation:

To mitigate the SQL Injection vulnerability, it is recommended to implement proper input validation and parameterized queries to prevent unauthorized access to the database. To mitigate the persistent XSS vulnerability, it is recommended to sanitize user input and encode special characters to prevent the execution of malicious code. Regularly updating Subrion CMS and its associated products is also advised.

Source

Exploit-DB raw data:

1.SUBRION CMS multiple vulnerabilties
  vendor: www.subrion.com
  Author: Karthik R (3psil0nLambDa)
  Email:  Karthik.cupid@gmail.com
  My blog: epsilonlambda.co.cc
  Google dork:  © 2011 Powered by Subrion CMS 

------------------------------------------------------------------------------------------------------------------------------------------------------------

Description about the CMS

  Subrion CMS unites the functionality of articles script, auto classifieds script, realty classifieds script, and web directory script all in one package. Subrion's highly scalable set of key features makes it a powerful   
  platform for web sites.
  Subrion CMS is easy to install and simple to manage. Use it as a stand-alone application or in conjunction with     other applications to create entry level sites, mid-sized or large sites. You can be confident that you will be     able to invest in this system and continue to grow it to any possible level.

------------------------------------------------------------------------------------------------------------------------------------------------------------
* SQLi  Vulnerability

The attackers can use the authentication bypass to get in to the admin panel in the site. 

Exploit: Username: ' or 0=0 #
	 Password: ' or 0=0 #

* Persistent XSS vulnerability

The Poll module,Manage pages are vulnerable to persistent XSS in the title field.

Exploit: "><IFRAME SRC="javascript:alert('XSS');"></IFRAME>


* Products like: Auto Classifieds, Articles Script, Auto Classifieds, Real estate script, Web directory run on the same CMS, and hence are vulnerable too.

------------------------------------------------------------------------------------------------------------------------------------------------------------

Thanks to side-effects for his valuable guidance and greets to taashu for her love and support.