FXRecruiter Arbitary File Upload Vulnerability

# Name: FXRecruiter Arbitary File Upload Vulnerability
 
# Vendor: http://www.fxrecruiter.co.uk & http://www.reversedelta.com
 
# Risk: High
 
# Date: 2011-03-27
 
# Author: Ashiyane Digital Security Team
 
# Contact: XroGuE_p3rsi4n_hack3r[at]Hotmail[Dot]com
 
# Home: www.Ashiyane.org/forums/
 
# Gr33tz: Behrooz_Ice,Virangar,And All Ashiyane Members !
 
==========================================================================
 
[+] Dork: intext:"Powered by FXRecruiter" & inurl:"page.php?page=*.php"
 
==========================================================================
[+] Note : You must Register at site, Then in "Upload CV Field" Select and
 
[-] Upload Your File, then Using "Live Http Header" Change ur File Format To Etc ...
 
[+] Uploaded path: http://127.0.0.1/fxmodules/resumes/[Your File].*
 
[+] Demo1: http://www.resourcing-solutions.com/fxmodules/resumes/haha_ehehe.html
 
[+] Demo2: http://www.energyintoenergy.com/fxmodules/resumes/p3rsi4n_hack3r_xrogue1.html
 
[+] Demo3: http://peoplemarketing.co.uk/fxmodules/resumes/black_xrogue.html
 
[+] Demo4: http://www.charles-hunter.com/fxmodules/resumes/black_hat_xrogue.html
 
[+] Demo5: http://www.activesolutionsrecruitment.com/fxmodules/resumes/black_hat_xrogue.html
==========================================================================
 
# Why I Put 5 Demo Site ????
 
*  For Some People That Think my Report's Is Fake or not AVAILABLE At Net... !!! :-l
 
$ Need Live Video ??? : ~>
 
 Video : http://www.vimeo.com/21464321
 
 Video http://www.4shared.com/file/AIwSyKn-/FXRecruiter_Arbitary_File_Uplo.html
 
==========================================================================
[+] Taghdim be Baxe Ashiyane, Happy New Year... omidVaram Sale KHoobi dashte bashin !
[+] Discovered By XroGuE !!! 



#  0day.today [2018-04-09]  #