'''
  __  __  ____         _    _ ____ 
 |  \/  |/ __ \   /\  | |  | |  _ \
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ <
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/
 
'''
 
Abysssec Inc Public Advisory
  
  
  Title            :  IfNuke Multiple Remote Vulnerabilities
  Affected Version :  IfNuke 4.0.0
  Discovery        :  www.abysssec.com
  Vendor       :  https://www.ifsoft.net/default.aspx
 
  Demo         :  https://www.ifsoft.net/default.aspx?portalName=demo
  Download Links   :  https://ifnuke.codeplex.com/            
               
 
  Admin Page       :  https://Example.com/Login.aspx?PortalName=_default
   
  
Description :
===========================================================================================     
  This version of IfNuke have Multiple Valnerabilities :
 
        1- arbitrary Upload file
    2- Persistent XSS
 
 
 
arbitrary Upload file
===========================================================================================    
 
  using this vulnerability you can upload any file with this two ways:
   
  1- https://Example.com/Modules/PreDefinition/PhotoUpload.aspx?AlbumId=1   (the value of AlbumId is necessary)
         
     your files will be in this path:
           https://Example.com/Users/Albums/
 
     with this format (for example):
           Shell.aspx ---> img_634150553723437500.aspx
 
That 634150553723437500 value is DateTime.Now.Ticks.ToString() and will be built in this file :
 
           https://Example.com/Modules/PreDefinition/PhotoUpload.ascx.cs          
           Ln 102 : fileName = "img_" + DateTime.Now.Ticks.ToString() + "." + GetFileExt(userPostedFile.FileName);
 
 
 
it's possible to do same thing here :
         
  2- https://Example.com/modules/PreDefinition/VideoUpload.aspx
 
   and the same vulnerable code is located here :
 
           https://Example.com/Modules/PreDefinition/VideoUpload.ascx.cs         
           Ln 39 : string createdTime = DateTime.Now.ToString("yyyyMMddHHmmssffff");
                   string newFileNameWithoutExtension = Path.GetFileNameWithoutExtension(fileName) + "_" + createdTime;
               string uploadFilePath = Server.MapPath(VideoHelper.GetVideoUploadDirectory(CurrentUser.Name) + newFileNameWithoutExtension + Path.GetExtension(fileName));
 
 
Persistent XSS Vulnerabilities:
===========================================================================================    
    
  In these Modules you can find Persistent XSS that data saves with no sanitization:
 
  1- Module name    : Article
     Fields         : Title , Description
     Valnerable Code: ...\Modules\PreDefinition\Article.ascx.cs
     ln 106:
            if (S_Title.Text.Trim() != string.Empty)
             {
                parameters.Add("@Title", S_Title.Text.Trim());
                parameters.Add("@Description", S_Title.Text.Trim());
                parameters.Add("@Tags", S_Title.Text.Trim());
             }  
 
     --------------------------------------------------------------------------------------
     
  2- Module name    : ArticleCategory
     Field          : Name
     Valnerable Code: ...\Modules\PreDefinition\ArticleCategory.ascx.cs
     ln 96:
           entity.Name = ((TextBox)lstSearch.Rows[lstSearch.EditIndex].FindControl("txtCategoryName_E")).Text.Trim();    
 
     --------------------------------------------------------------------------------------
     
  3- Module name    : HtmlText
     Field          : Text
     Valnerable Code: ...\Modules\PreDefinition\HtmlText.ascx.cs
     ln 66:
           entity.Content = txtContent.Value.Trim().Replace("//",string.Empty);
 
     --------------------------------------------------------------------------------------
     
  4- Module name    : LeaveMessage
     Fields         : NickName , Content
     Valnerable Code: ...\Modules\PreDefinition\LeaveMessage.ascx.cs
     ln 55:
           entity.NickName = txtNickName.Text.Trim();
           entity.Content = txtContent.Text.Trim();
 
     --------------------------------------------------------------------------------------
     
  5- Module name    : Link
     Field          : Title
     Valnerable Code: ...\Modules\PreDefinition\Link.ascx.cs
     ln 83:
           entity.Title = ((TextBox)lstSearch.Rows[lstSearch.EditIndex].FindControl("txtTitle_E")).Text.Trim();
 
     --------------------------------------------------------------------------------------
         
  6- Module name    : Photo
     Field          : Title
     Valnerable Code: ...\Modules\PreDefinition\Photo.ascx.cs
     ln 280:
           entity.Title = txtTitle_E.Text.Trim();
      
 
===========================================================================================