[FD] Pimcore v3.0.5 CMS - Multiple Web Vulnerabilities

Document Title: =============== Pimcore v3.0.5 CMS - Multiple Web Vulnerabilities References (Source): ==================== http://ift.tt/1cf3JDW Release Date: ============= 2015-05-08 Vulnerability Laboratory ID (VL-ID): ==================================== 1482 Common Vulnerability Scoring System: ==================================== 6.2 Product & Service Introduction: =============================== Pimcore is a powerful and robust Zend Framework based PHP content management system (CMS) for creating and managing digital content and assets licensed under the open-source BSD license. Create outstanding digital experiences on the most flexible content management platform available. Manage and edit any type of digital content, for any device and channel in a 100% flexible and personalized way. Pimcore features award-winning single-source and multi-channel publishing functionality making it easy to manage, update, and integrate content and data from various sources. With pimcore brands can create and manage rich digital experiences for all of their output channels at once: web, mobile, apps, social platforms, print and digital signage. With pimcore you can truly `edit once & reuse anywhere`. (Copy of the Homepage: http://ift.tt/1jbcb70 ) Abstract Advisory Information: ============================== An independent vulnerability laboratory researcher discovered multiple vulnerabilities in the official PIM Core v3.0.5 Content Management System. Vulnerability Disclosure Timeline: ================================== 2015-05-01: Researcher Notification & Coordination (Alain Homewood - PwC New Zealand) 2015-05-01: Vendor Notification (PimCore CMS Security Team) 2015-05-05: Vendor Response/Feedback (PimCore CMS Security Team) 2015-05-07: Vendor Fix/Patch (PimCore Developer Team) 2015-05-08: Public Disclosure (Vulnerability Laboratory - Alain Homewood) Discovery Status: ================= Published Affected Product(s): ==================== Pimcore GmbH Product: PimCore - Content Management System 3.0.5 Exploitation Technique: ======================= Remote Severity Level: =============== High Technical Details & Description: ================================ 1.1 A (time-based) blind sql injection web vulnerability has been discovered in the official Pimcore v3.0.5 Content Management System (web-application). The vulnerability allows remote attackers or privileged user accounts to execute own sql commands to compromise the affected web-server dbms. A blind authenticated SQL injection vulnerability exists in the filtering functionality of the HTTP error display in the administration panel. Authenticated is required to exploit this vulnerability, however low privilege users may have access to this functionality (i.e. its located under `Marketing - Search Engine Optimisation`). The request method to execute the malicious sql commands is GET and the issue is exists in the code line of the web-application. The security risk of the sql vulnerability is estimated as high with a cvss (common vulnerability scoring system) count of 6.2. Exploitation of the remote sql injection web vulnerability requires a low privilege application user account without user interaction. Successful exploitation of the sql injection vulnerability results in application and web-service or dbms compromise. Request Method(s): [+] GET Vulnerable Module(s): [+] ./misc/http-error-log Vulnerable Parameter(s): [+] _dc 1.2 A command execution web vulnerability has been discovered in the official Pimcore v3.0.5 Content Management System (web-application). The vulnerability allows remote attackers or local privilege user accounts to compromise the web-server by execution of malicious code. The newsletter sending functionality uses unsanitized user provided input as part of a shell command. Authenticated users can manipulate these values to execute arbitrary commands. Note that low privilege users are likely to have access to this functionality (e.g. marketing users). Authenticated is required to exploit this vulnerability. The request method to execute is POST and the attack vector is located on the application-side of the online service. The security risk of the arbitrary code execution vulnerability is estimated as high with a cvss (common vulnerability scoring system) count of 6.1. Exploitation of the arbitrary code execution vulnerability requires no user interaction but a low privilege web-application user account. Successful exploitation of the remote vulnerability results in unauthorized execution of system specific codes. Request Method(s): [+] POST Vulnerable Module(s): [+] /reports/newsletter/send Vulnerable Parameter(s): [+] HOST 1.3 Two reflected cross site scripting web vulnerability has been discovered in the official Pimcore v3.0.5 Content Management System (web-application). The vulnerability allows remote attackers to inject own script code on the client-side to the user (browser) application requests. Two reflected cross site scripting vulnerabilities exist in the administration panel. The issues are located in the `id` value of the echo back through the `exportClassAction()` and `exportCustomLayOutDefinitionAction()` functions of the `userClassController.php` file. The request method to execute is GET and the issues are located on the client-side of the online-service web application. The security risk of the cross site scripting web vulnerabilities are estimated as medium with a cvss (common vulnerability scoring system) count of 3.2. Exploitation of the arbitrary code execution vulnerability requires no user interaction or privileged web-application user account with password. Successful exploitation of the vulnerability results in session hijacking, persistent phishing, persistent external redirects and persistent manipulation function or connected module context. Request Method(s): [+] GET Vulnerable Module(s): [+] exportClassAction() [+] exportCustomLayOutDefinitionAction() Vulnerable File(s): [+] userClassController.php Vulnerable Parameter(s): [+] id Proof of Concept (PoC): ======================= 1.1 The blind sql injection web vulnerability can be exploited by remote attackers with low privilege application user account and low user interaction. For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue. Get requests to /admin/misc/http-error-log fail to sanitise the value of the "limit" parameter which allows users to inject SQL statements. The unsanitized value of the parameter is included in the following SQL query in MiscController.php: $logs = $db->fetchAll("SELECT code,uri,`count`,date FROM http_error_log " . $condition . " ORDER BY " . $sort . " " . $dir . " LIMIT " . $offset . "," . $limit); PoC or Exploitcode: This vulnerability can be exploited with a time based technique as described on: http://ift.tt/1GHuA9l

Source: Gmail -> IFTTT-> Blogger