eLouai's Download Script

ﾚﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄｿｳﾚﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾂﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄｿｳｳｳ Undergroundthalo Hacking Team - Security Advisory ｳｳｳﾚﾁ----------------------------------------ﾀｳﾙ-----------------------------------ﾁｿｳｳﾚｴ Author : cr4wl3r ｳ Release Date : 18-Okt-2012 ﾃｿｳｳｳｳ Product : Amateur Photographer's Image ｳ Size : 302.3 kB ｳｳｳｳｳｳ Link : http://sourceforge.net/projects/ap-imagegallery ｳｳｳｳﾃﾁ------------------------------------------ｳ-------------------------------------ﾁｴｳｳｳ gallery-0.9a.zip ｳｳｳｳﾀﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾁﾄﾄﾄﾁﾄﾄﾄﾁﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾙｳｳ Details ｳｳｳｳ Amateur Photographer's Image Gallery 0.9a ｳｳｳｳ A image gallery for photographers who don't care if their photos are publicly ｳｳ available on the web. Offers many advanced features such as image preloading ｳｳ which enables you to switch photos without waiting for the next photo to load. ｳｳ In this vulnerability, attacker can download any file from server. ｳｳ for example, downloading a configuration file contains information username ｳｳ database, another case attacker can inject database with SQL Injection ｳｳ or XSS only from URL ｳｳ------------------------------------------------------------------------------------ｳ RFD Code in force-download.php eLouai's Download ScriptERROR: download file NOT SPECIFIED. USE force-download.php?file=filepath"; exit; } elseif ( ! file_exists( $filename ) ) { echo "eLouai's Download ScriptERROR: File not found. USE force-download.php?file=filepath"; exit; }; switch( $file_extension ) { case "pdf": $ctype="application/pdf"; break; case "exe": $ctype="application/octet-stream"; break; case "zip": $ctype="application/zip"; break; case "doc": $ctype="application/msword"; break; case "xls": $ctype="application/vnd.ms-excel"; break; case "ppt": $ctype="application/vnd.ms-powerpoint"; break; case "gif": $ctype="image/gif"; break; case "png": $ctype="image/png"; break; case "jpeg": case "jpg": $ctype="image/jpg"; break; default: $ctype="application/force-download"; } header("Pragma: public"); // required header("Expires: 0"); header("Cache-Control: must-revalidate, post-check=0, pre-check=0"); header("Cache-Control: private",false); // required for certain browsers header("Content-Type: $ctype"); // change, added quotes to allow spaces in filenames, by Rajkumar Singh header("Content-Disposition: attachment; filename=\"".basename($filename)."\";" ); header("Content-Transfer-Encoding: binary"); header("Content-Length: ".filesize($filename)); readfile("$filename"); <------- BOOOOOOM exit(); ?> SQLi Code plist.php \n"; } // begin row $small = $row["small"]; $id = $row["id"]; echo "

"; // display cell if ($index == 3) { echo "\n"; $index = 1; } // end row else { $index = $index + 1; } // increment count } ?> SQLi Code fullscreen.php