28 lines
No EOL
1.6 KiB
Text
28 lines
No EOL
1.6 KiB
Text
Name : Freelancers Marketplace Script Upload Vulnerability
|
|
Date : july 17,2010
|
|
Critical Level : HIGH
|
|
vendor URL :http://www.guruscript.com/
|
|
google dork:Powered by Guruscript.com
|
|
Author : Sid3^effects aKa HaRi
|
|
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_,SeeMe,RoadKiller
|
|
greetz to :www.topsecure.net ,All ICW members and my friends :) luv y0 guyz
|
|
|
|
NOtice : The persistent Xss and upload vuln is in other 2 versions also namely Plus,Gold scripts
|
|
#######################################################################################################
|
|
Description:
|
|
Freelancers Marketplace Script is an Extensive and Powerful script written in PHP and Ajax to launch your own Freelancers website. Create your own global talent search marketplace with this script. Service seekers can post their requirements through this script and the service providers can place their bids for doing the job. Highly configurable features and fully customizable colors, styles, fonts and graphics make this script very very special.
|
|
#######################################################################################################
|
|
Xploit: Persistent Upload Vulnerability
|
|
|
|
Step 1 : Register as a user.
|
|
|
|
Step 2 : Now go and post your project
|
|
DEMO URL :http://site.com/post_project.php
|
|
|
|
Step 3 : The attacker can insert thier evil scripts or shells in the "describe" section.
|
|
|
|
Step 4 : Now check the main sites for the projects and you may find your script or shell ;)
|
|
DEMO URL : http://site.com/all_projects.php
|
|
#######################################################################################################
|
|
# 0day no more
|
|
# Sid3^effects |