============================================================= __ __ _ ___ _ __ ____ \ \ / / | | / _ \ (_) /_ | |___ \ ___ \ V / _ __ | | | | | | _ | | __) | _ __ / _ \ > < | '_ \ | | | | | | | | | | |__ < | '__| | __/ / . \ | |_) | | | | |_| | | | | | ___) | | | \___| /_/ \_\ | .__/ |_| \___/ |_| |_| |____/ |_| | | |_| blackpentesters.blogspot.com ============================================================= ########################################################################################### # Exploit Title: [ concrete5 CMS v5.6.1.2 Multiple CSRF and Stored XSS Vulnerabilities] # # Date: [2013-6-9] # # Exploit Author: [expl0i13r] # # Vendor Homepage: [http://www.concrete5.org/] # # Software Link: [http://www.concrete5.org/download_file/-/view/51635/8497/] # # Version: [5.6.1.2] # # Goole Dork: [Built with concrete5 - an open source CMS] # # Tested on: [Windows] # # Contact: expl0i13r@gmail.com # ########################################################################################### Summary: ======== 1. CSRF (Modify SMTP Settings) 2. CSRF (Modify Mail Importers Settings) 3. CSRF (Delete Form Results) 4. Stored XSS 1. CSRF (Modify SMTP Settings): ================================ concrete5 v5.6.1.2 suffers from multiple CSRF vulnerabilities one of which allow an attacker to modify "SMTP Settings" and "Send Mail Method" available at below URL : Affected URL: -------------- http://127.0.0.1/concrete5.6.1.2/concrete5.6.1.2/index.php/dashboard/system/mail/method/ ---------------------------------------------------------------------------------------- Note: Below code collects form details,send and update it, when Victim loads this page ---------------------------------------------------------------------------------------- 2. CSRF (Modify Mail Importer Settings) ========================================= Below code exploits CSRF vulnerability which allows attacker to Edit and update "Importer Settings" details. Affected URL : --------------- http://127.0.0.1/concrete5.6.1.2/concrete5.6.1.2/index.php/dashboard/system/mail/importers/edit_importer/1/ ---------------------------------------------------------------------------------------- Note: Below code collects form details,send and update them, when Victim loads this page ----------------------------------------------------------------------------------------

3. CSRF (Delete Form Results) =============================== Each Submissions available at "REPORTS" > "Form Results" page has static "qsID" assigned, using which attacker can delete submissions. Ex. --- When we install this CMS, "Contact Us" form by default available at URL : http://127.0.0.1/concrete5.6.1.2/concrete5.6.1.2/index.php/blog/hello-world/about/contact-us/ For above "Contact Form", qsID in my case is "1370626098", which can be found at url: -------------------------------------------------------------------------------------- http://127.0.0.1/concrete5.6.1.2/concrete5.6.1.2/index.php/dashboard/reports/forms/ -------------------------------------------------------------------------------------- Delete Submissions ------------------------------------------------------------------------------------------------------ In order to exploit this CSRF, attacker must have "qsID" values, for which attacker needs to have at least Limited access to CMS. Steps: ------ 1. Attacker logs in to CMS 2. Navigates to "http://127.0.0.1/concrete5.6.1.2/concrete5.6.1.2/index.php/dashboard/reports/forms/" 3. Gets Static "qsID" value from source code 4. Use "qsID" to create below CSRF exploit Code: ------- 4. Multiple Stored XSS ======================= concrete5 CMS also suffers from Stored XSS vulnerability, which can be used to "Delete Form Results" everytime page is loaded. Stored XSS-1 ============ URL: ---- http://127.0.0.1/concrete5.6.1.2/concrete5.6.1.2/index.php/dashboard/users/add_group/ Vulnerable Parameter: ---------------------- XSS-CSRF Payload: ------------------ "> Stored XSS-2: ============= URL: ----- http://127.0.0.1/concrete5.6.1.2/concrete5.6.1.2/index.php/dashboard/system/attributes/sets/ Vulnerable Parameter: ---------------------- Payload: --------- "> ################################## # eXpl0i13r # # ------------------------------ # #|blackpentesters.blogspot.com |# #|infotech-knowledge.blogspot.in|# # ------------------------------ # ##################################