openEngine 2.0 100226 – Local File Inclusion / Cross-Site Scripting

• Exploit Database
• 121 阅读

• 作者： SecPod Research
  日期： 2010-11-16
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/15557/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91

  ##############################################################################   SecPod Technologies (www.secpod.com)   Title: openEngine Local File Inclusion and XSS Vulnerabilities Vendor : http://www.openengine.de Advisory : http://secpod.org/blog/?p=152 http://secpod.org/advisories/SECPOD_Openengine_LFI_XSS_Vuln.txt Version: openEngine 2.0 100226; other versions may also be affected. Download : http://www.openengine.de/download/openengine20_100226.zip Date : 11/16/2010   ###############################################################################   SecPod ID:100910/20/2010 Issue Discovered     Class:Local File Inclusion and XSS Severity: High     Overview: --------- openEngine is prone to local file inclusion and XSS vulnerabilities.     Technical Description: ---------------------- openEngine is prone to a local file inclusion and XSS vulnerabilities. The application fails to properly sanitize user-supplied input.   Input passed via the &apos;template&apos; parameter in "cms/website.php" is not properly verified before it is returned to the user. This can be exploited to obtain potentially sensitive information and execute arbitrary HTML, script code in an users browser session in the context of an affected site.   The exploit has been tested on openEngine 2.0 100226     Impact: -------- Successful exploitation allows an attacker to obtain potentially sensitive information and execute arbitrary arbitrary HTML, script code in the context of an affected site.     Affected Software: ------------------ openEngine 2.0 100226; other versions may also be affected.     References: ----------- http://www.openengine.de http://secpod.org/blog/?p=152 http://secpod.org/advisories/SECPOD_Openengine_LFI_XSS_Vuln.txt     Proof of Concepts: ------------------ * local file inclusion, http://localhost/cms/website.php?template=../../../../../../../../etc/passwd%00   * XSS, http://localhost/cms/website.php?template=<script>alert(document.cookie)</script>   Workaround: ----------- Not available     Solution: ---------- Not available     Risk Factor: ------------- CVSS Score Report: ACCESS_VECTOR= NETWORK ACCESS_COMPLEXITY= MEDIUM AUTHENTICATION = NOT_REQUIRED CONFIDENTIALITY_IMPACT = PARTIAL INTEGRITY_IMPACT = PARTIAL AVAILABILITY_IMPACT= PARTIAL EXPLOITABILITY = PROOF_OF_CONCEPT REMEDIATION_LEVEL= UNAVAILABLE REPORT_CONFIDENCE= CONFIRMED CVSS Base Score= 6.8 (AV:N/AC:M/Au:NR/C:P/I:P/A:P) CVSS Temporal Score= 6.1 Risk factor= High