Ananta Gazelle CMS Shell Upload Vulnerability

=============================================
Ananta Gazelle CMS Shell Upload Vulnerability
=============================================

 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
 0     _                   __           __       __                     1
 1   /' \            __  /'__`\        /\ \__  /'__`\                   0
 0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
 1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
 0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
 1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
 0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
 1                  \ \____/ >> Exploit database separated by exploit   0
 0                   \/___/          type (local, remote, DoS, etc.)    1
 1                                                                      1
 0  [+] Site            : Inj3ct0r.com                                  0
 1  [+] Support e-mail  : submit[at]inj3ct0r.com                        1
 0                                                                      0
 1                    ########################################          1
 0                    I'm eidelweiss member from Inj3ct0r Team          1
 1                    ########################################          0
 0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1


Software Link: www.anantasoft.com
Download: http://www.anantasoft.com/index.php?Gazelle%20CMS/Download
Author: eidelweiss
Contact: g1xsystem[at]windowslive.com

Special Thank`s To: Inj3ct0r.com (Inj3ct0r Exploit DataBase) iwe a.k.a KirD , PKI a.k.a Andri klaten, m4rc0, and YOU !!!!!

================================================================

This vulnerability isssue can be exploited or use by attacker to upload arbitary shell script to gain access,
or data.

1. You Need To Register Your self
2. When your account active (registed) after activate your account by clicking on following link in your mail,
    then login with type your user name and password .
3. after you login successful click "To admin panel" or "To user panel" and/or you will be direct to

	http://sample.site/ananta_path/admin
		or
	http://sample.site/ananta-path/user.php

4. Then go to or copy and paste this link:

	"/admin/editor/filemanager/frmupload.html"	// (without quote)

	ex: http://sample.site/admin/editor/filemanager/frmupload.html

5. Upload your script backdoor shell there
6. If success or lucky your backdoor shell can be check or will be available here:

	http://sample.site/admin/editor/backdoorshellfile.extention	(Ananta_Gazelle1.0/admin/editor/filemanager/connectors/php/config.php	//line 27)

		or

	http://sample.site/user/backdoorshellfile.extention		(Ananta_Gazelle1.0/admin/editor/filemanager/connectors/php/config.php	//line 27)


NOTE: Edit your backdoor shell by adding GIF or JPG source, so you can get the shell.


=========================| -=[ E0F ]=- |============================



#  0day.today [2018-04-14]  #