iScripts CyberMatch Shell Upload

`# Title:iScripts cyberMatch Upload vulnerability  
# Author: Sid3^effects   
# Published: 2010-06-05   
# price:$147  
# email:[email protected]   
# vendor: iScripts  
# url : http://www.iscripts.com/cybermatch/  
# google dork : Powered by iScripts Cybermatch  
  
############################################################################  
  
ooooo .oooooo. oooooo oooooo oooo   
  
`888' d8P' `Y8b `888. `888. .8'   
  
888 888 `888. .8888. .8'   
  
888 888 `888 .8'`888. .8'   
  
888 888 `888.8' `888.8'   
  
888 `88b ooo `888' `888'   
  
o888o `Y8bood8P' `8' `8'   
  
  
--------------------------------------------------------------------------------------   
  
#####################Sid3^effects aKa HaRi##################################   
  
#Greetz to all Andhra Hackers and ICW Memebers[Indian Cyber Warriors]   
  
#Thanks:*L0rd ÇrusAdêr*,d4rk-blu™®,R45C4L,CR4C|< 008,M4n0j,MaYuR   
  
#ShouTZ:kedar,dec0d3r,41.w4r10r  
  
#spl shoutz:LiquidWorm,gunslinger_ :D   
  
#Catch us at www.andhrahackers.com or www.teamicw.in   
  
############################################################################   
Description :   
  
iScripts CyberMatch is an online dating software. You can create professional dating site using this script. You can customize the online dating portal to your members' needs, by selecting the features you want to support. As the source code is not encrypted you are free to modify the software to meet your requirements. Even though we at iscripts.com are happy to do any modifications for look and feel and functionality, you are free to use any programmer or designer.   
  
############################################################################   
  
Xploit :  
  
The attackercan upload malicious script in certain description areas..  
  
One such url is   
  
demo url:http://www.iscripts.com/cybermatch/demo/admin/settings.php  
  
By using a wel crafted evil script the attacker can upload a shell as well as in description areas they can execute thier evil scripts.  
  
  
  
############################################################################   
  
#Sid3^effects   
  
  
  
  
  
  
  
  
`