264d15855e
14 new exploits FRticket Ticket System - Stored XSS Viart Shopping Cart 5.0 - CSRF Shell Upload Easy RM to MP3 Converter 2.7.3.700 - (.m3u) Exploit with Universal DEP+ASLR Bypass Dream Gallery 2.0 - Admin Panel Authentication Bypass Grid Gallery 1.0 - Admin Panel Authentication Bypass Joomla PayPlans (com_payplans) Extension 3.3.6 - SQL Injection Zabbix 2.2 - 3.0.3 - RCE with API JSON-RPC iSQL 1.0 - Shell Command Injection iSQL 1.0 - isql_main.c Buffer Overflow PoC Foxit PDF Reader 1.0.1.0925 - CPDF_StreamContentParser::~CPDF_StreamContentParser Heap-Based Memory Corruption Foxit PDF Reader 1.0.1.0925 - CPDF_DIBSource::TranslateScanline24bpp Out-of-Bounds Read Foxit PDF Reader 1.0.1.0925 - CFX_WideString::operator= Invalid Read Foxit PDF Reader 1.0.1.0925 -kdu_core::kdu_codestream::get_subsampling Memory Corruption Foxit PDF Reader 1.0.1.0925 - CFX_BaseSegmentedArray::IterateIndex Memory Corruption
42 lines
No EOL
1.3 KiB
Text
Executable file
42 lines
No EOL
1.3 KiB
Text
Executable file
<!--
|
|
# Exploit Title: Grid Gallery 1.0 - Admin panel Authentication bypass
|
|
# Date: 13th June 2016
|
|
# Exploit Author: Ali BawazeEer
|
|
# Vendor Homepage: http://phpstaff.com.br/
|
|
# Version: 2.0
|
|
|
|
--!>
|
|
|
|
|
|
=======================================================================================================
|
|
|
|
Grid Gallery 1.0 Admin panel Authentication bypass
|
|
|
|
Description : An Attackers are able to completely compromise the web application built upon
|
|
Grid Gallery as they can gain access to the admin panel and
|
|
manage the website as an admin without prior authentication!
|
|
|
|
|
|
Step 1: Create a rule in No-Redirect Add-on: ^http://example.com/path/admin/login.php
|
|
Step 2: Access http://example.com/path/admin/index.php
|
|
|
|
|
|
Risk : Unauthenticated attackers are able to gain full access to the administrator panel
|
|
and thus have total control over the web application, including content change,add admin user .. etc
|
|
|
|
=======================================================================================================
|
|
potential fix
|
|
|
|
|
|
<?php
|
|
session_start();
|
|
if (!isset($_SESSION["auth"])) {
|
|
exit(header('Location: admin/login.php'));
|
|
}
|
|
|
|
?>
|
|
|
|
|
|
[+] Exploit by: Ali BawazeEer
|
|
[+] Twitter:@AlibawazeEer
|
|
[+] Linkedin : https://www.linkedin.com/in/AliBawazeEer |