Sorcery Blog
Adminer is a PHP database management tool. It has support for running queries on SQLite databases. In versions 4.2.4 and before it was possible to get RCE using the SQLite functionality by creating a database file with the .php extension and inserting PHP code like this: ATTACH DATABASE 'shell.php' AS lol; CREATE TABLE lol.pwn (dataz text); INSERT INTO lol.pwn ( dataz) VALUES ( '<?php…
Some vulnerabilities require you to have a file on the server containing your payload. One common mechanism for this is through image uploads. There is a variety of techniques people use for this such as embedding the payload in EXIF data, image comments or bypassing the upload form by adding a fake GIF header to the start of the file. These techniques work a lot of the time but they may often be…
CFOR stands for Cross Fork Object Reference. It’s an information disclosure vulnerability where deleted commits or commits from private forks can be exposed if you know the commit hash, it’s similar to an IDOR. The details about the flaw can be read in this blog post by TruffleSecurity who discovered the issue. After reading that blog post I started writing an exploit script for it to…
This blog post explores a critical vulnerability in MyBB ’s admin panel, leading to authenticated Remote Code Execution (RCE). MyBB is a popular forum software with a template system that utilizes eval() to render templates. We will discuss how this vulnerability in the admin panel’s template handling can be exploited for RCE. We can change these templates in the admin panel. When we…
Two modules that we tested by MyPrestaModules have a vulnerability where PHPInfo is exposed to an unauthenticated attacker. The modules SimpleImportProduct and UpdateProducts contain a file called send.php that has the following code snippet: if ( Tools :: getValue ( 'phpinfo' ) ){ phpinfo (); die ; } This exposes PHPInfo information which is useful to an attacker and it requires no authentication…
This blog post details an SQL Injection we found within SimpleImportProduct, a Prestashop module developed by MyPrestaModules . In modules/simpleimportproduct/send.php there is the following code: if ( Tools :: getValue ( 'remove' ) == true ){ $key = Tools :: getValue ( 'key' ); $key = pSQL ($key); Db :: getInstance () -> delete ( 'simpleimport_tasks' , 'import_settings= $key ' ); This is…
This blog post details an XSS we found within the FieldPopupNewsletter module, developed by FieldThemes , for the popular ecommerce platform Prestashop. The module contains a file called ajax.php with the following code: $ppp = new FieldPopupNewsletter (); echo $ppp -> newsletterRegistration ($_POST[ 'email' ]); The newsletterRegistration function, called by the ajax.php file, contains code that…
This is a belated stub post about SQLi vulnerabilities I found in XIPBlog (a Prestashop modules developed by Xpert-Idea) back in 2021. The technical details are available on the advisory here . Timeline Date Action 22/06/2021 Issue discovered during a pentest 26/06/2021 Submitted pull request on their Github repo 09/02/2022 Pull request accepted 02/12/2022 202-ecommerce find the same vulnerability…
We initially became interested in the __VSTATE parameter after reading this article by graanl which we saw after reading this article from The Record about an APT group exploiting how it works. What is a ViewState? A ViewState is a parameter that contains information about the state of a users session, eg. are they logged in, who are they logged in as, what settings have they changed. In .NET this…
I first decided to look at phpPgAdmin after reading this blog post that someone wrote up about abusing it to get a bug bounty. After reading through the source I discovered a bug in the library it was using to interact with Postgres. When a user logs in the username and password is filtered by this function: function adodb_addslashes ($s) { $len = strlen ($s); if ($len == 0 ) return '''' ; if (…
In order to understand this bug I first read through the Wordfence blog post and then read through through the Redux Framework source code to fill in the gaps. I also installed Wordpress with this plugin so that I didn’t have to test things blindly. The relevant code is in inc/class.redux_instances.php . The first hook I looked at is this one: $hash = md5 ( trailingslashit ( network_site_url…
This blog post details an SQLi I found in the SmartBlog Prestashop module by SmartDataSoft . First we need to talk about how the Prestashop pSQL function works and what it does. pSQL() is intended for string escaping, so for example if you have a query like: $sql = 'SELECT * FROM myTable WHERE name=' $name '' If $name has quotes in it then it can break out of the quotes. If $name is james' and…
This blog post details an SQLi I found in Blog for Prestashop (ph_simpleblog) by Prestahome , it is also my first CVE 😊 To begin with I had to identify that the module was installed, it is a blog plugin so this can generally be spotted by looking at the page source of the blog but you can also test if Prestashop modules are installed more directly by checking…
Adminer is a popular PHP database management tool. This blog post will detail its vulnerabilities, how to exploit them and how to protect yourself from these risks. RCE using SQLite Versions 4.2.4 and before that support SQLite are vulnerable to this. The server must have the SQLite PHP driver installed for this to work. On Adminer you login with an empty username and database name. This will log…
Back in 2018 Binance had been targeted by a large scale attack by a group of phishers. They made a bounty offer of $250k in BNB to anyone who could provide information leading to their arrest. In the Medium post they provided a list of known phishing domains for people to investigate. I went through the list to see which of the sites were still active: Domain IP kykoin.com 178.208.83.9 bitxumb.com…
Discovery Usually we find this when directory bruteforce returns positive results from the following urls: http://site.com/.git/ http://site.com/.git/config http://site.com/.git/HEAD http://site.com/.git/index Many times the .git/ may be 403 (due to directory listing being disabled) but the files within it are downloadable. A lot of the git files are at known paths and the rest can be worked out…