39 lines
No EOL
1 KiB
Text
39 lines
No EOL
1 KiB
Text
[~] Flax Article Manager 1.1 Remote File Upload Vulnerability
|
|
[~]
|
|
[~] ----------------------------------------------------------
|
|
[~] Discovered By: S.W.A.T. svvateam@yahoo.com
|
|
[~]
|
|
[~] Home: www.batlagh.com
|
|
[~]
|
|
[~] Script Page: http://www.clixint.com/products/articles
|
|
[~]
|
|
[~] Dork: Copyright 2006 © Flax Article Manager v1.1
|
|
[~] -----------------------------------------------------------
|
|
|
|
Xpl:
|
|
|
|
1.First Register Into The Site ( link: www.site.com/[path]/register.php )
|
|
|
|
2.Login With Your Username & Password
|
|
|
|
3.Choose A Picture For Your Avatar You Can Use All Extention File Ex: c99.php
|
|
[In Edit Profile] Or [Register Page] You Can Select The File
|
|
|
|
4.Your Shell Will Be Appear In This Folder ( link: www.site.com/[path]/images/author_pics/[random id]_avatar.php )
|
|
|
|
5.Go To This Url: www.site.com/[path]/profile.php?author_id=[Your Author ID] Then Right Click On The Pic And Use Properties To Find Out The Link Of Shell Script
|
|
|
|
6.Hack The Site ;)
|
|
|
|
|
|
Demo:
|
|
|
|
http://www.articlesitedemo.com
|
|
|
|
|
|
|
|
[~] Me:
|
|
|
|
I'll Be A C I D A L !!!
|
|
|
|
# milw0rm.com [2009-01-27] |