7ebfc36557
24 changes to exploits/shellcodes/ghdb ASUS ASMB8 iKVM 1.14.51 - Remote Code Execution (RCE) Ruckus IoT Controller 1.7.1.0 - Undocumented Backdoor Account Dell EMC iDRAC7/iDRAC8 2.52.52.52 - Remote Code Execution (RCE) FLIR AX8 1.46.16 - Remote Command Injection ABB Cylon Aspect 3.08.02 - Cross-Site Request Forgery (CSRF) Ethercreative Logs 3.0.3 - Path Traversal Garage Management System 1.0 (categoriesName) - Stored XSS Nagios Log Server 2024R1.3.1 - Stored XSS ProConf 6.0 - Insecure Direct Object Reference (IDOR) Teedy 1.11 - Account Takeover via Stored Cross-Site Scripting (XSS) WooCommerce Customers Manager 29.4 - Post-Authenticated SQL Injection ABB Cylon Aspect 3.08.03 (webServerDeviceLabelUpdate.php) - File Write DoS ABB Cylon Aspect 4.00.00 (factorySaved.php) - Unauthenticated XSS ABB Cylon Aspect 4.00.00 (factorySetSerialNum.php) - Remote Code Execution Car Rental Project 1.0 - Remote Code Execution KodExplorer 4.52 - Open Redirect NagVis 1.9.33 - Arbitrary File Read phpMyFAQ 3.1.7 - Reflected Cross-Site Scripting (XSS) phpMyFAQ 3.2.10 - Unintended File Download Triggered by Embedded Frames Smart Manager 8.27.0 - Post-Authenticated SQL Injection Zabbix 7.0.0 - SQL Injection Hugging Face Transformers MobileViTV2 4.41.1 - Remote Code Execution (RCE) Fortinet FortiOS_ FortiProxy_ and FortiSwitchManager 7.2.0 - Authentication bypass WebMethods Integration Server 10.15.0.0000-0092 - Improper Access on Login Page
45 lines
No EOL
1.9 KiB
Text
45 lines
No EOL
1.9 KiB
Text
# Exploit Title: phpMyFAQ v3.2.10 - Unintended File Download Triggered by Embedded Frames
|
||
# Date: 13 Dec 2024
|
||
# Exploit Author: George Chen
|
||
# Vendor Homepage: https://github.com/thorsten/phpMyFAQ/
|
||
# Software Link: https://github.com/thorsten/phpMyFAQ/
|
||
# Version: v3.2.10
|
||
# Tested on: Mac, Win
|
||
# CVE : CVE-2024–55889
|
||
|
||
|
||
*Summary*
|
||
A vulnerability exists in the FAQ Record component of
|
||
https://github.com/thorsten/phpMyFAQ v3.2.10 where a privileged attacker
|
||
can trigger a file download on a victim’s machine upon page visit by
|
||
embedding it in an <iframe> element without user interaction or explicit
|
||
consent.
|
||
|
||
*Details*
|
||
In http://localhost/admin/index.php?action=editentry&id=20&lang=en, where a
|
||
FAQ record is either created or edited, an attacker can insert an iframe,
|
||
as “source code”, pointing to a prior “malicious” attachment that the
|
||
attacker has uploaded via FAQ “new attachment” upload, such that any page
|
||
visits to this FAQ will trigger an automated download (from the edit
|
||
screen, download is automated; from the faq page view as a normal user,
|
||
depending on the browser, a pop up confirmation may be presented before the
|
||
actual download. Firebox browser, for instance, does not require any
|
||
interactions).
|
||
|
||
[image: image.png]
|
||
|
||
*PoC*
|
||
|
||
1. create a new FAQ record and upload a “malicious” file — in my case, I
|
||
uploaded an eicar file. Take note of the uri, ie
|
||
“index.php?action=attachment&id=2”
|
||
2. in the FAQ record, insert a “source code” blob using the “< >” button
|
||
3. insert in the following snippet and save FAQ record:
|
||
<p><iframe src="index.php?action=attachment&id=2"></iframe></p> [image:
|
||
image.png]
|
||
4. Once the edit page reloads, the malicious code will be downloaded
|
||
onto the local machine without user interaction:[image: image.png]
|
||
|
||
Advisory:
|
||
https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-m3r7-8gw7-qwvc
|
||
Disclosure: https://geochen.medium.com/cve-2024-55889-03572ae6c35c |