Haraj Script Stored XSS and File Upload Vulnerability

=============================
1:) first enter to site of our target , and signup in the target site .
2:) go to (HTTP://TARGET.COM/home/add/) or (HTTP://TARGET.COM/home_add.html) or 
or (HTTP://TARGET.COM/add.html) or  or (HTTP://TARGET.COM/modules/home.php?action=add) . or click in the ( add ads buttom ).

3:) this is the emportant step ..

     1:Choose anything from properties, to complete all!
     2: You must in all fields Put this {

<script language="javascript" type="text/javascript">
alert('Your xss code here !!! .. Hacked !');
</script>
''''3'42'34'2#$"$#%"$%"^$"%6<>/>/>?>?>?>?>?././/.>?>?>?>"???"?">'>">">">">">">">">">"
{php}echo 1337; {/php} 

}
     3: In the field of image,Then choose the evil_file  that you want to upload it on the target
if it said just ( .jpg ) file , put it like these ( shell.php.jpg ) then edit it with ( tamper data ) tool to (  shell.php ) .

4:) Make sure you put the human verification code,,and submit the form .
5:)  Go to the home ( ./index.php) you will find Your XSs , and the (ads) click it and click the On the white space on the page , You will going to Your (EVIL_FILE) , in fact you can find your file here ( http://www.target.com/images/uploads/property/Akram{$rander_num}.php )
$rander_num = You can find it when   click the On the white space on the page on Show the html Source .

Greetz: b0x , sec4ever , x1x , 1001 , sultan

#  0day.today [2018-04-08]  #