By exploitdb papers bot•April 24, 2010•
papers
Understanding NCT Jobs Portal Script Vulnerabilities: XSS and Authentication Bypass
Understanding NCT Jobs Portal Script Vulnerabilities: XSS and Authentication Bypass
What this paper is
This paper, published by Sid3^effects on April 24, 2010, details two security vulnerabilities found in the NCT Jobs Portal Script. These vulnerabilities are:
- Authentication Bypass: An attacker can gain unauthorized access to the admin panel.
- Cross-Site Scripting (XSS): An attacker can inject malicious scripts into the application, which can then be executed in the victim's browser.
The paper provides specific attack patterns for exploiting these weaknesses.
Simple technical breakdown
The NCT Jobs Portal Script, a web application designed for creating job portals, has flaws in how it handles user input for login and search functionalities.
- Authentication Bypass: The script likely doesn't properly validate the credentials provided during the admin login process. By using a specific SQL injection-like pattern, an attacker can trick the database query into always evaluating to true, thereby bypassing the need for a valid username and password.
- XSS: The search functionality within the portal does not sanitize user input. This means that if a user searches for something containing HTML or JavaScript code, the script will directly embed that code into the web page's output without cleaning it. When another user views that page, their browser will execute the injected script.
Complete code and payload walkthrough
The provided paper does not contain any executable code or shellcode. Instead, it describes the attack vectors and the specific strings to be used as payloads.
Authentication Bypass Payload:
- Attack Pattern:
' or 1=1 or ''=' - Explanation: This string is designed to be injected into the username and password fields of the admin login form.
': This likely closes an existing string literal in the SQL query.or 1=1: This is a classic SQL injection technique. TheORcondition makes the entireWHEREclause of the SQL query evaluate to true, regardless of the original username and password.or ''=': This part is a bit redundant but might be there to handle different SQL syntax variations or to ensure the condition remains true even if the firstor 1=1is somehow problematic in a specific context. The empty string comparison''='will always be true.
- Mapping:
' or 1=1 or ''='-> SQL Injection payload to bypass authentication.
XSS Payload:
- Attack Pattern:
'"--><script>alert(0x000872)</script> - Explanation: This string is intended for the search fields (
Keywords,Tags, orDesired City).": This likely closes an existing HTML attribute value.'--: This is a comment in SQL, often used to terminate the original query string and prevent syntax errors. It might also be intended to comment out parts of the HTML/JavaScript context.>: This closes an HTML tag.<script>alert(0x000872)</script>: This is the actual JavaScript payload. When executed by the victim's browser, it will display a JavaScript alert box with the hexadecimal value0x000872(which is 2130 in decimal). This is a common proof-of-concept for XSS.
- Mapping:
'"--><script>alert(0x000872)</script>-> XSS payload to demonstrate script execution.
Note: The paper explicitly states "Code : []", indicating that no exploit code was provided, only the attack strings.
Practical details for offensive operations teams
When planning authorized engagements involving this type of vulnerability:
- Required Access Level: Typically, no initial elevated access is required. The vulnerabilities are exploitable through the web interface.
- Lab Preconditions:
- A running instance of the NCT Jobs Portal Script (or a similar PHP web application with comparable input handling).
- Knowledge of the target application's login page URL and search functionality.
- A web browser for manual testing or a web proxy (like Burp Suite or OWASP ZAP) for automated testing and payload injection.
- Tooling Assumptions:
- Web Proxy: Essential for intercepting and modifying HTTP requests to inject payloads.
- SQL Map (or similar): Can be used to automate the authentication bypass if the underlying database and injection point are identifiable.
- Browser Developer Tools: Useful for observing how the XSS payload is reflected in the HTML response.
- Execution Pitfalls:
- WAF/IPS Evasion: Modern Web Application Firewalls (WAFs) or Intrusion Prevention Systems (IPS) might detect and block these simple payloads. Obfuscation techniques or variations of the payloads might be necessary.
- Contextual Differences: The exact payload might need slight adjustments based on how the application constructs its SQL queries or renders HTML. For XSS, the closing characters (like
"or') and comment characters (--) are crucial and depend on the surrounding code. - Authentication Bypass Complexity: If the application uses prepared statements or has other input sanitization mechanisms in place, the simple
' or 1=1 or ''='might not work directly. More advanced SQL injection techniques might be required. - XSS Payload Effectiveness: The
alert()payload is a proof-of-concept. For actual data exfiltration or session hijacking, more sophisticated JavaScript would be needed, which would also be more likely to be detected.
- Tradecraft Considerations:
- Reconnaissance: Thoroughly map the application's structure, identify all input fields, and understand their purpose.
- Payload Crafting: Start with simple, well-known payloads and gradually increase complexity if needed.
- Verification: Always verify the exploit's success. For authentication bypass, confirm access to the admin panel. For XSS, observe the script execution (e.g., the alert box).
- Documentation: Meticulously document all steps, payloads used, and observed results.
Where this was used and when
- Context: This vulnerability was found in the NCT Jobs Portal Script, a commercial web application.
- Timeframe: The paper was published in April 2010. This indicates the vulnerability was likely present and exploitable around that period. It's unknown if this specific script is still in widespread use or if vendors have patched it.
Defensive lessons for modern teams
- Input Validation and Sanitization: This is paramount. All user-supplied input, whether for login, search, or any other function, must be rigorously validated and sanitized.
- For Authentication: Use parameterized queries or prepared statements for database interactions to prevent SQL injection. Never concatenate user input directly into SQL queries. Implement rate limiting and account lockout mechanisms.
- For XSS: Sanitize all output that is displayed to users. This involves encoding special characters (like
<,>,&,",') to their HTML entity equivalents. Use context-aware output encoding.
- Principle of Least Privilege: Ensure that application components and user roles have only the necessary permissions.
- Regular Security Audits and Patching: Conduct regular code reviews and penetration tests. Promptly apply security patches provided by vendors.
- Web Application Firewalls (WAFs): While not a silver bullet, WAFs can provide an additional layer of defense by detecting and blocking common attack patterns. However, they should not be relied upon as the sole security measure.
- Secure Coding Practices: Educate developers on common web vulnerabilities and secure coding best practices.
ASCII visual (if applicable)
This scenario can be visualized as a simplified interaction flow:
+-----------------+ +-------------------+ +-----------------+
| Attacker |----->| NCT Jobs Portal |----->| Database |
| (Browser/Proxy) | | Web Application| | |
+-----------------+ +-------------------+ +-----------------+
| |
| 1. Inject Payload | 2. Process Request
| (e.g., ' or 1=1) | (Vulnerable Logic)
| |
| | 3. Execute Query
| | (Returns True)
| |
+------------------------+ 4. Grant Access
(Authentication Bypass)
+-----------------+ +-------------------+ +-----------------+
| Attacker |----->| NCT Jobs Portal |----->| Victim's |
| (Browser/Proxy) | | Web Application| | Browser |
+-----------------+ +-------------------+ +-----------------+
| |
| 1. Inject Payload | 2. Reflect Input
| (e.g., <script>) | Unsanitized
| |
| | 3. Render HTML
| | with Script
| |
+------------------------+ 4. Execute Script
(XSS)Source references
- Paper ID: 12370
- Paper Title: NCT Jobs Portal Script - Cross-Site Scripting / Authentication Bypass
- Author: Sid3^effects
- Published: 2010-04-24
- Paper URL: https://www.exploit-db.com/papers/12370
Original Exploit-DB Content (Verbatim)
# Exploit Title: XSS and Authentication bypass in NCT Jobs Portal Script
# Date: 24-apr-2010
# Author: Sid3^effects
# Software Link: N/a
# CVE : []
# Code : [] ______________________________________________________________________________
XSS and Authentication bypass in NCT Jobs Portal Script
Vendor:http://www.ncrypted.net/
___________________________Author:Sid3^effects_________________________________
Description :
NCT Jobs Portal script is a web product for running powerful and customized job portals. Be it a fresh site that you want to launch or be it for integration into your already existing website, NCT Jobs Portal is everything you need when it comes to job portal or business networking solution. Jobs Portal comes with a front-end and a back-end (Admin Panel). Admin Panel has a wide range of functions along with a CMS (Content Management System) which will easily enpower you to customize and manage your very own Jobs Portal.
script cost :$99
---------------------------------------------------------------------------
* Authentication bypass:
The following script has authentication bypass in the admin login
use ' or 1=1 or ''=' in both login and password.
---------------------------------------------------------------------------
* XSS (cross site scripting ) :
XSS is also found in the search field.
Parameter Name: Keywords or Tags or Desired City
Parameter Type: Querystring
Attack Pattern: '"--><script>alert(0x000872)</script>
---------------------------------------------------------------------------
ShoutZ :
-------
---Indian Cyber warriors--Andhra hackers--
Greetz :
--------
---*L0rd ÇrusAdêr*---d4rk-blu™® [ICW]---R45C4L idi0th4ck3r---CR4C|< 008---M4n0j--