bugtraq - Social Engine 4.x (Music Plugin) Arbitrary File Upload Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <201012261806.oBQI6Bwv023931@www3.securityfocus.com>
Date: Sun, 26 Dec 2010 11:06:11 -0700
From: MyDoom2009@...il.com
To: bugtraq@...urityfocus.com
Subject: Social Engine 4.x (Music Plugin) Arbitrary File Upload Vulnerability

###########################################################################
# Exploit Title: Social Engine 4.x (Music Plugin) Arbitrary File Upload
# Google Dork: inurl:"user/auth/forgot"
# Date: 22/12/2010
# Author: MyDoom ( Moroccan Hacker )
# Contact: MyDoom2009@...il.com
# Software Link: http://http://www.socialengine.net
# Version: Social Engine 4.x (should work on previous versions but no tested)
# Tested on: Windows 7 - Linux 3.6.33 2010 - Linux 3.6.18 2010 -
Windows Server 2003
# Greetz to : ALBoraaq Hackers ;) - Especially T3es
###########################################################################
 
Vulnerable Javascript Source Code:
 
          window.addEvent('domready', function() { // wait for the content
 
               ...snip...
 
                         // remove that line to select all files, or edit it, add more items
                         typeFilter: {
                               'Music (*.mp3,*.m4a,*.aac,*.mp4)': '*.mp3; *.m4a; *.aac; *.mp4'
                           },
 
Description:
 
The File filter used in the code don't check the uploaded file but
only set the type of files that can be veiwed in the upload window
so if we type  *.*    in the filename we will see all others file and
then we can upload any type of file.
 
Exploit:
 
[~] Step 1 : Find A social network using the Social Engine with MUSIC PLUGIN
 
[~] Step 2: Register A Fake Account
 
[~] Step 3: Click On Music Link in the menu or go to http://www.xxxx.com/music
 
[~] Step 4: Click On Upload Music And Then Fill the Playlist info
 
[~] Step 5: Click On Add Music And Select The php file ( If you can
see php file in the upload window type *.* in the file name )
 
[~] Step 6: And Click on save music to playlist
 
[~] Step 7: You Will See the Music Player Move the Cursor on the php
filename and copy the link of the shell.
 
Generaly it will be :
http://www.xxx.com/public/music_song/1000000/[numbers]/[user_id]/[some_numbers].php