CMS from Scratch 1.1.3 - image.php Directory Traversal

CMS from Scratch 1.1.3 - image.php Directory Traversal ------------------------------------------------------------------------ CMS from Scratch special THanks to EgiX For founded it :d: Exploit : http://localhost/path/cms/images.php?dir=c: Example :...

LightBlog 9.5 cp_upload_image.php Remote File Upload Vulnerability

Exploit for unknown platform in category web applications ================================================================== LightBlog 9.5 cpuploadimage.php Remote File Upload Vulnerability ================================================================== LightBlog 9.5 - REMOTE FILE UPLOAD...

lightblog-upload.txt

LightBlog 9.5 - REMOTE FILE UPLOAD VULNERABILITY by Omni 1 Infos --------- Date : 2008-01-30 Product : LightBlog Version : v 9.5 Vendor : http://www.publicwarehouse.co.uk/ Vendor Status : 2008-01-31 Informed! 2008-01-31 Patch received from vendor! 2008-02-01 Published! Description : Lightblog...

LightBlog 9.5 - 'cp_upload_image.php' Arbitrary File Upload

LightBlog 9.5 - REMOTE FILE UPLOAD VULNERABILITY by Omni 1 Infos --------- Date : 2008-01-30 Product : LightBlog Version : v 9.5 Vendor : http://www.publicwarehouse.co.uk/ Vendor Status : 2008-01-31 Informed! 2008-01-31 Patch received from vendor! 2008-02-01 Published! Description : Lightblog...

LightBlog 9.5 cp_upload_image.php Remote File Upload Vulnerability

No description provided by source. LightBlog 9.5 - REMOTE FILE UPLOAD VULNERABILITY by Omni 1 Infos --------- Date : 2008-01-30 Product : LightBlog Version : v 9.5 Vendor : http://www.publicwarehouse.co.uk/ Vendor Status : 2008-01-31 Informed! 2008-01-31 Patch received from vendor! 2008-02-01...

Docebo 3.5.0.3 - lib.regset.php Command Execution

Docebo 3.5.0.3 - lib.regset.php Command Execution getListTable." WHERE browsercode LIKE '%".$browserlanguage."%'"; executeQuery$qtxt; 801. 802. if $q && mysqlnumrows$q 0 803. $row=mysqlfetcharray$q; 804. $res=$row"regionid"; 805. an attacker cuold be inject SQL code through http accept-language...

Docebo 3.5.0.3 - 'lib.regset.php' Command Execution

getListTable." WHERE browsercode LIKE '%".$browserlanguage."%'"; executeQuery$qtxt; 801. 802. if $q && mysqlnumrows$q 0 803. $row=mysqlfetcharray$q; 804. $res=$row"regionid"; 805. an attacker cuold be inject SQL code through http accept-language header in the query at line 799, but explode functi...

MySpace Content Zone 3.x - Arbitrary File Upload

---------------------------------------------------- +-MySpace Content Zone RFi-+ ---------------------------------------------------- Found By Don & breakerunit ---------------------------------------------------- Vuln file: /admin/uploadgames.php Fix: secure admin area Dork: "Powered by MySpace...

MonAlbum 0.87 - Arbitrary File Upload / Password Grabber

!/usr/bin/env perl use strict; use warnings; use LWP::UserAgent; use HTTP::Request::Common; use Getopt::Std; my %args, $user, $password, $sqlhost, $sqluser, $sqlpassword, $cookie, $path, $file, $upload = ; my $tmp = 'cmd1.jpg'; getopts"u:a:f:p:", %args; -a don't retrieve login and passwords, use...

MonAlbum 0.87 - Arbitrary File Upload Password Grabber

MonAlbum 0.87 - Arbitrary File Upload Password Grabber !/usr/bin/env perl use strict; use warnings; use LWP::UserAgent; use HTTP::Request::Common; use Getopt::Std; my %args, $user, $password, $sqlhost, $sqluser, $sqlpassword, $cookie, $path, $file, $upload = ; my $tmp = 'cmd1.jpg';...

MonAlbum 0.87 Upload Shell / Password Grabber Exploit

Exploit for unknown platform in category web applications ===================================================== MonAlbum 0.87 Upload Shell / Password Grabber Exploit ===================================================== !/usr/bin/env perl use strict; use warnings; use LWP::UserAgent; use...

ProfileCMS 1.0 Remote File Upload Vulnerability Shell Upload Exploit

No description provided by source. ProfileCMS v1.0 Shell Upload Exploit Demo : http://slrate.com/ You can direct upload PHP shell instead of image while creating profile at this script, For example http://slrate.com/profiles here you can direct upload shell instead of images. Dorks : "Total...

ProfileCMS 1.0 - Arbitrary File Upload

ProfileCMS v1.0 Shell Upload Exploit Demo : http://slrate.com/ You can direct upload PHP shell instead of image while creating profile at this script, For example http://slrate.com/profiles here you can direct upload shell instead of images. Dorks : "Total Generators & Widgets" "Powered By...

MKPortal 1.0/1.1 - 'admin.php' Authentication Bypass

source: https://www.securityfocus.com/bid/25515/info MKPortal is prone to an authentication-bypass vulnerability because it fails to restrict access to certain administrative functions. Attackers can exploit this issue to gain unauthorized access to the application. Versions prior to MKPortal 1.1...

Pakupaku CMS 0.4 - Arbitrary File Upload Local File Inclusion

Pakupaku CMS 0.4 - Arbitrary File Upload Local File Inclusion !/usr/bin/perl Pakupaku CMS = 0.4 Remote File Upload Vulnerability 1- PathScript/index.php?page=Uploads 2- Upload GoLd-M.php = Php Shell 3- PathScript/uploads/GoLd-M.php = Php Shell D.Script :...

CyBoards PHP Lite 1.21 - 'script_path' Remote File Inclusion

!/usr/bin/perl CyBoards PHP Lite 1.21 scriptpath Remote File Include Exploit Coded by bd0rk || SOH-Crew Usage: exploit.pl target cmd shell shell variable Greetings: str0ke, TheJT, Kacper, Lu7k, Maik Vulnerable Code: include"$scriptpath/include/defaultstyle.css"; Vendor:...

PostNuke Module phgstats 0.5 - phgdir Remote File Inclusion

PostNuke Module phgstats 0.5 - phgdir Remote File Inclusion PostNuke Module phgstats 0.5 phgdir Remote File Include Exploit Vendor: http://kent.dl.sourceforge.net/sourceforge/phgstats/phgstats0.5.zip Vulnerable Code: includeonce$phgdir . 'settings/config.inc.php'; Coded by bd0rk || SOH-Crew Usage...

VisoHotlink "mosConfig_absolute_path"远程文件包含漏洞

VisoHotlink是一款基于PHP的WEB应用程序。 VisoHotlink不正确过滤用户提交的输入，远程攻击者可以利用漏洞以WEB权限执行任意命令。 问题是'includes/functions.visohotlink.php'脚本对用户提交的'"mosConfigabsolutepath"'参数缺少过滤，指定远程服务器上的文件作为包含参数，可导致以WEB权限执行任意命令。 VisoHotlink 1.x 目前没有解决方案提供： http://www.easy-script.com/compt.php?id=3312 !/usr/bin/perl VisoHotlink 1.0...

Axiom Photo Gallery Template.PHP远程文件包含漏洞

Axiom Photo Gallery是一款基于PHP的WEB应用程序。 Axiom Photo Gallery不正确过滤用户提交的输入，远程攻击者可以利用漏洞以WEB权限执行任意命令。 问题是'Template.PHP'脚本对用户提交的'sphppath'参数缺少过滤，指定远程服务器上的文件作为包含参数，可导致以WEB权限执行任意命令。 Axiom Axiom Photo Gallery 8.6 目前没有解决方案提供： http://superb-west.dl.sourceforge.net/sourceforge/axiompng/...

L2J Statistik Script <= 0.09 (index.php page) Local File Include Exploit

No description provided by source. ? print ' | \ | \ \ / | | | | | | | \ \ \ / \ \ | \ \ / \ | \ | | | / \ | \ \ \ / / | | | | | | | | | | ||/ // |./ |/\ ./ |/ ||...