724CMS Multiple Vulnerability

[Aerosol]

724CMS 5.01 / 4.59 / 4.01 / 3.01 Information Leakage

*724CMS 5.01 Multiple Information Leakage Security Vulnerabilities*



Exploit Title: 724CMS Multiple Information Leakage Security Vulnerabilities

Vendor: 724CMS

Product: 724CMS

Vulnerable Versions: 3.01   4.01   4.59   5.01

Tested Version: 5.01

Advisory Publication: March 14, 2015

Latest Update: March 14, 2015

Vulnerability Type: Information Exposure [CWE-200]

CVE Reference: *

Impact CVSS Severity (version 2.0):

CVSS v2 Base Score: 5.0 (MEDIUM) (AV:N/AC:L/Au:N/C:P/I:N/A:N) (legend)

Impact Subscore: 2.9

Exploitability Subscore: 10.0

Credit: Wang Jing [Mathematics, Nanyang Technological University (NTU),
Singapore]








*Suggestion Details:*



*(1) Vendor & Product Description:*



*Vendor:*

724CMS Enterprise




*Product & Vulnerable Versions:*

724CMS

3.01

4.01

4.59

5.01






*Vendor URL & download:*

724CMS can be got from here,

http://724cms.com/




*Product Introduction Overview:*

724CMS is a content management system (CMS) that has large customers spread
in Canada, Japan, Korean, the United States and many others. It allows
publishing, editing and modifying content, organizing, deleting as well as
maintenance from a central interface. Meanwhile, 724CMS provides procedures
to manage workflow in a collaborative environment.







*(2) Vulnerability Details:*

724CMS web application has a security bug problem. It can be exploited by
information leakage attacks - Full Path Disclosure (FPD). This may allow a
remote attacker to disclose the software's installation path. While such
information is relatively low risk, it is often useful in carrying out
additional, more focused attacks.


Several 724CMS products vulnerabilities have been found by some other bug
hunter researchers before. 724CMS has patched some of them. NVD is the U.S.
government repository of standards based vulnerability management data
(This data enables automation of vulnerability management, security
measurement, and compliance (e.g. FISMA)). It has published suggestions,
advisories, solutions related to 724CMS vulnerabilities.



*(2.1)* The first code programming flaw occurs at "index.php" page with
"&Lang", "&ID" parameters.


*(2.2)* The second code programming flaw occurs at "section.php" page with
"&Lang", "&ID" parameters.








*References:*

http://tetraph.com/security/information-leakage-vulnerability/724cms-5-01-information-leakage-security-vulnerabilities/

http://securityrelated.blogspot.com/2015/03/724cms-501-information-leakage-security.html

http://www.inzeed.com/kaleidoscope/computer-web-security/724cms-5-01-information-leakage-security-vulnerabilities/

http://diebiyi.com/articles/%E5%AE%89%E5%85%A8/724cms-5-01-information-leakage-security-vulnerabilities/

https://infoswift.wordpress.com/2015/03/14/724cms-5-01-information-leakage-security-vulnerabilities/

http://marc.info/?l=full-disclosure&m=142576280203098&w=4

http://en.hackdig.com/wap/?id=17055






--

Wang Jing,

Division of Mathematical Sciences (MAS),

School of Physical and Mathematical Sciences (SPMS),

Nanyang Technological University (NTU),

Singapore.

http://www.tetraph.com/wangjing/

https://twitter.com/tetraphibious

724CMS 5.01 / 4.59 / 4.01 / 3.01 Directory Traversal

*724CMS 5.01 Directory (Path) Traversal Security Vulnerabilities*


Exploit Title: 724CMS /section.php Module Parameter Directory Traversal
Security Vulnerabilities
Vendor: 724CMS
Product: 724CMS
Vulnerable Versions: 3.01   4.01   4.59   5.01
Tested Version: 5.01
Advisory Publication: March 14, 2015
Latest Update: March 14, 2015
Vulnerability Type: Improper Limitation of a Pathname to a Restricted
Directory ('Path Traversal') [CWE-22]
CVE Reference: *
Impact CVSS Severity (version 2.0):
CVSS v2 Base Score: 7.5 (HIGH) (AV:N/AC:L/Au:N/C:P/I:P/A:P) (legend)
Impact Subscore: 6.4
Exploitability Subscore: 10.0
Discover and Author: Wang Jing [CCRG, Nanyang Technological University
(NTU), Singapore]







*Recommendation Details:*


*(1) Vendor & Product Description:*


*Vendor:*
724CMS Enterprise



*Product & Vulnerable Versions:*
724CMS
3.01
4.01
4.59
5.01





*Vendor URL & download:*
724CMS can be bargained from here,
http://724cms.com/



*Product Introduction Overview:*
"724CMS is a content management system (CMS) that has customers spread in
Canada, Japan, Korean, the United States, European and many others. It
allows publishing, editing and modifying content, organizing, deleting as
well as maintenance from a central interface. Meanwhile, 724CMS provides
procedures to manage workflow in a collaborative environment."

"A CMS helps you create and store content in a shared repository. It then
manages the relationships between content items for you (e.g. keeping track
of where they fit into the site hierarchy). Finally, it ensures that each
content item is connected to the right style sheet when it comes to be
published. Some CMSs also provide facilities to track the status of content
items through editorial processes and workflows."






*(2) Vulnerability Details:*
724CMS web application has a security bug problem. It can be exploited by
Directory Traversal - Local File Include (LFI) attacks. A local file
inclusion (LFI) flaw is due to the script not properly sanitizing user
input, specifically path traversal style attacks (e.g. '../../') supplied
to the parameters. With a specially crafted request, a remote attacker can
include arbitrary files from the targeted host or from a remote host . This
may allow disclosing file contents or executing files like PHP scripts.
Such attacks are limited due to the script only calling files already on
the target host.

Several 724CMS products vulnerabilities have been found by some other bug
hunter researchers before. 724CMS has patched some of them. The MITRE
Corporation is a not-for-profit company that operates multiple federally
funded research and development centers (FFRDCs), which provide innovative,
practical solutions for some of our nation's most critical challenges in
defense and intelligence, aviation, civil systems, homeland security, the
judiciary, healthcare, and cybersecurity. It has published suggestions,
advisories, solutions details related to 724CMS vulnerabilities.


*(2.1) *The first cipher programming flaw occurs at "/section.php" page
with "&Module" parameter.









*References:*
http://www.tetraph.com/security/directory-traversal-vulnerability/724cms-5-01-directory-path-traversal-security-vulnerabilities/
http://securityrelated.blogspot.com/2015/03/724cms-501-directory-path-traversal.html
http://www.inzeed.com/kaleidoscope/computer-web-security/724cms-5-01-directory-path-traversal-security-vulnerabilities/
http://diebiyi.com/articles/%E5%AE%89%E5%85%A8/724cms-5-01-directory-path-traversal-security-vulnerabilities/
https://computertechhut.wordpress.com/2015/03/14/724cms-5-01-directory-path-traversal-security-vulnerabilities/
http://marc.info/?a=139222176300014&r=1&w=4
http://en.hackdig.com/wap/?id=17404







--
Wang Jing,
Division of Mathematical Sciences (MAS),
School of Physical and Mathematical Sciences (SPMS),
Nanyang Technological University (NTU),
Singapore.
http://www.tetraph.com/wangjing/
https://twitter.com/justqdjing

724CMS 5.01 / 4.59 / 4.01 / 3.01 SQL Injection

*724CMS 5.01 Multiple SQL Injection Security Vulnerabilities*


Exploit Title: 724CMS Multiple SQL Injection Security Vulnerabilities
Vendor: 724CMS
Product: 724CMS
Vulnerable Versions: 3.01   4.01   4.59   5.01
Tested Version: 5.01
Advisory Publication: March 14, 2015
Latest Update: March 14, 2015
Vulnerability Type: Improper Neutralization of Special Elements used in an
SQL Command ('SQL Injection') [CWE-89]
CVE Reference: *
Impact CVSS Severity (version 2.0):
CVSS v2 Base Score: 7.5 (HIGH) (AV:N/AC:L/Au:N/C:P/I:P/A:P) (legend)
Impact Subscore: 6.4
Exploitability Subscore: 10.0
Credit: Wang Jing [Mathematics, Nanyang Technological University (NTU),
Singapore]







*Recommendation Details:*


*(1) Vendor & Product Description:*


*Vendor:*
724CMS Enterprise



*Product & Vulnerable Versions:*
724CMS
3.01
4.01
4.59
5.01





*Vendor URL & download:*
724CMS can be gain from here,
http://724cms.com/



*Product Introduction Overview:*
"724CMS is a content management system (CMS) that has customers spread in
Canada, Japan, Korean, the United States, European and many others. It
allows publishing, editing and modifying content, organizing, deleting as
well as maintenance from a central interface. Meanwhile, 724CMS provides
procedures to manage workflow in a collaborative environment."

"A CMS helps you create and store content in a shared repository. It then
manages the relationships between content items for you (e.g. keeping track
of where they fit into the site hierarchy). Finally, it ensures that each
content item is connected to the right style sheet when it comes to be
published. Some CMSs also provide facilities to track the status of content
items through editorial processes and workflows."






*(2) Vulnerability Details:*
724CMS web application has a security bug problem. It can be exploited by
SQL Injection attacks. This may allow an attacker to inject or manipulate
SQL queries in the back-end database, allowing for the manipulation or
disclosure of arbitrary data.

Several 724CMS products vulnerabilities have been found by some other bug
hunter researchers before. 724CMS has patched some of them. The MITRE
Corporation is a not-for-profit company that operates multiple federally
funded research and development centers (FFRDCs), which provide innovative,
practical solutions for some of our nation's most critical challenges in
defense and intelligence, aviation, civil systems, homeland security, the
judiciary, healthcare, and cybersecurity. It has phase, votes, comments and
proposed details related to 724CMS vulnerabilities.


*(2.1)* The first cipher programming flaw  occurs at "/index.php" page with
"&Lang", "&ID" parameters.

*(2.2) *The second cipher programming flaw occurs at "/section.php" page
with "&Lang", "&ID" parameters.








*References:*
http://www.tetraph.com/security/sql-injection-vulnerability/724cms-5-01-multiple-sql-injection-security-vulnerabilities/
http://securityrelated.blogspot.com/2015/03/724cms-501-multiple-sql-injection.html
http://www.inzeed.com/kaleidoscope/computer-web-security/724cms-5-01-multiple-sql-injection-security-vulnerabilities/
http://diebiyi.com/articles/%E5%AE%89%E5%85%A8/724cms-5-01-multiple-sql-injection-security-vulnerabilities/
https://computertechhut.wordpress.com/2015/03/14/724cms-5-01-multiple-sql-injection-security-vulnerabilities/
https://www.mail-archive.com/fulldisclosure%40seclists.org/msg01766.html
http://marc.info/?a=139222176300014&r=1&w=4
http://en.1337day.com/exploit/23308






--
Wang Jing,
Division of Mathematical Sciences (MAS),
School of Physical and Mathematical Sciences (SPMS),
Nanyang Technological University (NTU),
Singapore.
http://www.tetraph.com/wangjing/
https://twitter.com/tetraphibious

724CMS 5.01 / 4.59 / 4.01 / 3.01 Cross Site Scripting

*724CMS 5.01 Multiple XSS (Cross-site Scripting) Security Vulnerabilities*


Exploit Title: 724CMS Multiple XSS (Cross-site Scripting) Security
Vulnerabilities
Vendor: 724CMS
Product: 724CMS
Vulnerable Versions: 3.01   4.01   4.59   5.01
Tested Version: 5.01
Advisory Publication: March 15, 2015
Latest Update: March 15, 2015
Vulnerability Type: Cross-Site Scripting [CWE-79]
CVE Reference: *
Impact CVSS Severity (version 2.0):
CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)
Impact Subscore: 2.9
Exploitability Subscore: 8.6
Credit: Wang Jing [Mathematics, Nanyang Technological University (NTU),
Singapore]






*Recommendation Details:*


*(1) Vendor & Product Description:*


*Vendor:*
724CMS Enterprise



*Product & Vulnerable Versions:*
724CMS
3.01
4.01
4.59
5.01





*Vendor URL & download:*
724CMS can be purchased from here,
http://724cms.com/



*Product Introduction Overview:*
"724CMS is a content management system (CMS) that has customers spread in
Canada, Japan, Korean, the United States, European and many others. It
allows publishing, editing and modifying content, organizing, deleting as
well as maintenance from a central interface. Meanwhile, 724CMS provides
procedures to manage workflow in a collaborative environment."

"A CMS helps you create and store content in a shared repository. It then
manages the relationships between content items for you (e.g. keeping track
of where they fit into the site hierarchy). Finally, it ensures that each
content item is connected to the right style sheet when it comes to be
published. Some CMSs also provide facilities to track the status of content
items through editorial processes and workflows."






*(2) Vulnerability Details:*
724CMS web application has a security bug problem. It can be exploited by
XSS attacks. This may allow a remote attacker to create a specially crafted
request that would execute arbitrary script code in a user's browser
session within the trust relationship between their browser and the server.

Several 724CMS products vulnerabilities have been found by some other bug
hunter researchers before. 724CMS has patched some of them. The MITRE
Corporation is a not-for-profit company that operates multiple federally
funded research and development centers (FFRDCs), which provide innovative,
practical solutions for some of our nation's most critical challenges in
defense and intelligence, aviation, civil systems, homeland security, the
judiciary, healthcare, and cybersecurity. It has published suggestions,
advisories, solutions details related to 724CMS vulnerabilities.


*(2.1)* The first code programming flaw occurs at "/index.php" page with
"&Lang" parameter.

*(2.2) *The second code programming occurs at "/section.php" page with
"&Lang", "&ID", "&Nav" parameters.








*References:*
http://www.tetraph.com/security/xss-vulnerability/724cms-5-01-multiple-xss-cross-site-scripting-security-vulnerabilities/
http://securityrelated.blogspot.com/2015/03/724cms-501-multiple-xss-cross-site.html
http://www.inzeed.com/kaleidoscope/computer-web-security/724cms-5-01-multiple-xss-cross-site-scripting-security-vulnerabilities/
http://diebiyi.com/articles/%E5%AE%89%E5%85%A8/724cms-5-01-multiple-xss-cross-site-scripting-security-vulnerabilities/
https://computertechhut.wordpress.com/2015/03/14/724cms-5-01-multiple-xss-cross-site-scripting-security-vulnerabilities/
http://marc.info/?l=full-disclosure&m=142576259903051&w=4
https://www.mail-archive.com/fulldisclosure%40seclists.org/msg01737.html
http://en.hackdig.com/?16117.htm






--
Wang Jing,
Division of Mathematical Sciences (MAS),
School of Physical and Mathematical Sciences (SPMS),
Nanyang Technological University (NTU),
Singapore.
http://www.tetraph.com/wangjing/
https://twitter.com/tetraphibious