Ananta Gazelle CMS Shell Upload

`==========================================================  
Ananta Gazelle CMS Shell Upload Vulnerability  
==========================================================  
  
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0  
0 _ __ __ __ 1  
1 /' \ __ /'__`\ /\ \__ /'__`\ 0  
0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1  
1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0  
0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1  
1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0  
0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1  
1 \ \____/ >> Exploit database separated by exploit 0  
0 \/___/ type (local, remote, DoS, etc.) 1  
1 1  
0 [+] Site : Inj3ct0r.com 0  
1 [+] Support e-mail : submit[at]inj3ct0r.com 1  
0 0  
1 ######################################## 1  
0 I'm eidelweiss member from Inj3ct0r Team 1  
1 ######################################## 0  
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1  
  
  
Software Link: www.anantasoft.com  
Download: http://www.anantasoft.com/index.php?Gazelle%20CMS/Download  
Author: eidelweiss  
Contact: g1xsystem[at]windowslive.com  
  
Special Thank`s To: iwe a.k.a KirD , PKI a.k.a Andri klaten, m4rc0, and YOU !!!!!  
  
================================================================  
  
This vulnerability isssue can be exploited or use by attacker to upload arbitary shell script to gain access,  
or data.  
  
1. You Need To Register Your self  
2. When your account active (registed) after activate your account by clicking on following link in your mail,  
then login with type your user name and password .  
3. after you login successful click "To admin panel" or "To user panel" and/or you will be direct to  
  
http://sample.site/ananta_path/admin  
or  
http://sample.site/ananta-path/user.php  
  
4. Then go to or copy and paste this link:  
  
"/admin/editor/filemanager/frmupload.html" // (without quote)  
  
ex: http://sample.site/admin/editor/filemanager/frmupload.html  
  
5. Upload your script backdoor shell there  
6. If success or lucky your backdoor shell can be check or will be available here:  
  
http://sample.site/admin/editor/backdoorshellfile.extention (Ananta_Gazelle1.0/admin/editor/filemanager/connectors/php/config.php //line 27)  
  
or  
  
http://sample.site/user/backdoorshellfile.extention (Ananta_Gazelle1.0/admin/editor/filemanager/connectors/php/config.php //line 27)  
  
  
NOTE: Edit your backdoor shell by adding GIF or JPG source, so you can get the shell.  
  
  
=========================| -=[ E0F ]=- |============================  
`