what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

phpMyBackupPro 2.5 Shell Upload

phpMyBackupPro 2.5 Shell Upload
Posted Feb 16, 2016
Authored by hyp3rlinx | Site hyp3rlinx.altervista.org

phpMyBackupPro version 2.5 suffers from a remote shell upload vulnerability.

tags | exploit, remote, shell
SHA-256 | 50e0dd607fcedc615a8d0c0bb3ddd9ce81b3c8539d4cc0cf6c76e00f347911ce

phpMyBackupPro 2.5 Shell Upload

Change Mirror Download
[+] Credits: hyp3rlinx

[+] Website: hyp3rlinx.altervista.org

[+] Source:
http://hyp3rlinx.altervista.org/advisories/PHPMYBACKUPPRO-v2.5-FILE_UPLOAD_VULN.txt



Vendor:
=============================
www.phpmybackuppro.net

project site:
sourceforge.net/projects/phpmybackup/



Product:
===========================
phpMyBackupPro v.2.5 (PMBP)

phpMyBackup Pro is a very easy to use, free, web-based MySQL backup
application, licensed under the GNU GPL.
You can create scheduled backups, manage and restore them, download or
email them and a lot more.



Vulnerability Type:
========================
Arbitrary File Upload



CVE Reference:
==============
N/A



Vulnerability Details:
=====================

phpMyBackupPro allows SQL uploads but fails to check the actual file type,
allowing arbitrary file uploads which
can lead to arbitrary OS command, backdoor shells etc...



Exploit code(s):
===============

Arbitary File Upload under "database queries" user has option to 'Upload
sql file':

1) upload malicious PHP file containing <?php exec(@$_GET['cmd']); ?> as an
SQL import using select "fragmented".
2) click 'Yes' when prompted 'Do you really want to import this backup?'
3) make HTTP request to process the uploaded PHP file e.g.
http://localhost/phpMyBackupPro-2.5/export/EVIL.php and BOOOOOOM!

'export' directory comes unprotected with no .htaccess file etc.. and most
important file upload type is not checked.



Disclosure Timeline:
=====================================
Vendor Notification: NR
February 16, 2016 : Public Disclosure



Exploitation Technique:
=======================
Local



Severity Level:
================
High



Description:
=============================================================

Request Method(s): [+] POST


Vulnerable Product: [+] phpMyBackupPro v.2.5 (PMBP)


============================================================

[+] Disclaimer
Permission is hereby granted for the redistribution of this advisory,
provided that it is not altered except by reformatting it, and that due
credit is given. Permission is explicitly given for insertion in
vulnerability databases and similar, provided that due credit is given to
the author.
The author is not responsible for any misuse of the information contained
herein and prohibits any malicious use of all security related information
or exploits by the author or elsewhere.

by hyp3rlinx
Login or Register to add favorites

File Archive:

July 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    27 Files
  • 2
    Jul 2nd
    10 Files
  • 3
    Jul 3rd
    35 Files
  • 4
    Jul 4th
    27 Files
  • 5
    Jul 5th
    18 Files
  • 6
    Jul 6th
    0 Files
  • 7
    Jul 7th
    0 Files
  • 8
    Jul 8th
    28 Files
  • 9
    Jul 9th
    44 Files
  • 10
    Jul 10th
    24 Files
  • 11
    Jul 11th
    25 Files
  • 12
    Jul 12th
    11 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    28 Files
  • 16
    Jul 16th
    6 Files
  • 17
    Jul 17th
    34 Files
  • 18
    Jul 18th
    6 Files
  • 19
    Jul 19th
    34 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    19 Files
  • 23
    Jul 23rd
    17 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close