ifnuke - Multiple Vulnerabilities

'''
  __  __  ____         _    _ ____
 |  \/  |/ __ \   /\  | |  | |  _ \
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ <
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/

'''

Abysssec Inc Public Advisory


  Title            :  IfNuke Multiple Remote Vulnerabilities
  Affected Version :  IfNuke 4.0.0
  Discovery        :  www.abysssec.com
  Vendor	   :  http://www.ifsoft.net/default.aspx

  Demo  	   :  http://www.ifsoft.net/default.aspx?portalName=demo
  Download Links   :  http://ifnuke.codeplex.com/


  Admin Page       :  http://Example.com/Login.aspx?PortalName=_default


Description :
===========================================================================================
  This version of IfNuke have Multiple Valnerabilities :

        1- arbitrary Upload file
	2- Persistent XSS



arbitrary Upload file
===========================================================================================

  using this vulnerability you can upload any file with this two ways:

  1- http://Example.com/Modules/PreDefinition/PhotoUpload.aspx?AlbumId=1   (the value of AlbumId is necessary)

     your files will be in this path:
           http://Example.com/Users/Albums/

     with this format (for example):
           Shell.aspx ---> img_634150553723437500.aspx

That 634150553723437500 value is DateTime.Now.Ticks.ToString() and will be built in this file :

           http://Example.com/Modules/PreDefinition/PhotoUpload.ascx.cs
           Ln 102 : fileName = "img_" + DateTime.Now.Ticks.ToString() + "." + GetFileExt(userPostedFile.FileName);



it's possible to do same thing here :

  2- http://Example.com/modules/PreDefinition/VideoUpload.aspx

   and the same vulnerable code is located here :

           http://Example.com/Modules/PreDefinition/VideoUpload.ascx.cs
           Ln 39 : string createdTime = DateTime.Now.ToString("yyyyMMddHHmmssffff");
                   string newFileNameWithoutExtension = Path.GetFileNameWithoutExtension(fileName) + "_" + createdTime;
          	   string uploadFilePath = Server.MapPath(VideoHelper.GetVideoUploadDirectory(CurrentUser.Name) + newFileNameWithoutExtension + Path.GetExtension(fileName));


Persistent XSS Vulnerabilities:
===========================================================================================

  In these Modules you can find Persistent XSS that data saves with no sanitization:

  1- Module name    : Article
     Fields         : Title , Description
     Valnerable Code: ...\Modules\PreDefinition\Article.ascx.cs
     ln 106:
            if (S_Title.Text.Trim() != string.Empty)
             {
            	parameters.Add("@Title", S_Title.Text.Trim());
            	parameters.Add("@Description", S_Title.Text.Trim());
            	parameters.Add("@Tags", S_Title.Text.Trim());
             }

     --------------------------------------------------------------------------------------

  2- Module name    : ArticleCategory
     Field          : Name
     Valnerable Code: ...\Modules\PreDefinition\ArticleCategory.ascx.cs
     ln 96:
           entity.Name = ((TextBox)lstSearch.Rows[lstSearch.EditIndex].FindControl("txtCategoryName_E")).Text.Trim();

     --------------------------------------------------------------------------------------

  3- Module name    : HtmlText
     Field          : Text
     Valnerable Code: ...\Modules\PreDefinition\HtmlText.ascx.cs
     ln 66:
           entity.Content = txtContent.Value.Trim().Replace("//",string.Empty);

     --------------------------------------------------------------------------------------

  4- Module name    : LeaveMessage
     Fields         : NickName , Content
     Valnerable Code: ...\Modules\PreDefinition\LeaveMessage.ascx.cs
     ln 55:
           entity.NickName = txtNickName.Text.Trim();
           entity.Content = txtContent.Text.Trim();

     --------------------------------------------------------------------------------------

  5- Module name    : Link
     Field          : Title
     Valnerable Code: ...\Modules\PreDefinition\Link.ascx.cs
     ln 83:
           entity.Title = ((TextBox)lstSearch.Rows[lstSearch.EditIndex].FindControl("txtTitle_E")).Text.Trim();

     --------------------------------------------------------------------------------------

  6- Module name    : Photo
     Field          : Title
     Valnerable Code: ...\Modules\PreDefinition\Photo.ascx.cs
     ln 280:
           entity.Title = txtTitle_E.Text.Trim();


===========================================================================================