0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
PHPOPENCHAT 3.0.2 Cross Site Scripting AND/OR FPD
[=================================================
PHPOPENCHAT 3.0.2 Cross Site Scripting AND/OR FPD
=================================================
The PoC:
1.- Preview
This web APP is Vulnerable to xss in its instalation file but you can
misconfigurate all the
code with this bug also, you must see to understand...
2.- Vulnerable Code
function database_setup(){
if( isset($_POST['form_data']) ){
$host = (string) $_POST['DATABASE_HOST'];
$user = (string) $_POST['DATABASE_USER'];
$pass = (string) $_POST['DATABASE_PASSWORD'];
$tabl = (string) $_POST['DATABASE_TABLESPACE'];
$prefix = (string) $_POST['DATABASE_TABLE_PREFIX'];
3.- Expl0tation
First Bug its where you just post data without nothing in security so
you can put in the
host textbox on the install.php?step=2 ">
in which usually
is written localhost and in other .php files (install.php) they show
$host so the Xss its
notable...
4.- More Vuln Code...
$this->set_conf_property('DATABASE_HOST', $host);
you may think theres no problem with this step but...
if you write the DATABSE_HOST with host being explotated it could
be...interesting...
5.- MORE
define('DATABASE_HOST', 'localhost');
This is the execelent example to show you how it can work like a PHP DROP...
just put something like "> in the
DATABASE_HOST textbox
and excecute, just refresh and...
Path Disclosure...
\openchat\config.inc.php on line 135
6.- Gr33tz:
http://www.seguridadblanca.org - WCuestas - Chelano - Perverths0 -
SeguridadBlanca READERS
- Exploit-DB && FRIENDS =)
# 0day.today [2024-10-06] #