Ananta Gazelle CMS Shell Upload Vulnerability

2010.08.25
Credit: eidelweiss
Risk: High
Local: No
Remote: Yes
CVE: N/A
CWE: N/A

========================================================== Ananta Gazelle CMS Shell Upload Vulnerability ========================================================== 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 _ __ __ __ 1 1 /' \ __ /'__`\ /\ \__ /'__`\ 0 0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1 1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0 0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1 1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0 0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1 1 \ \____/ >> Exploit database separated by exploit 0 0 \/___/ type (local, remote, DoS, etc.) 1 1 1 0 [+] Site : Inj3ct0r.com 0 1 [+] Support e-mail : submit[at]inj3ct0r.com 1 0 0 1 ######################################## 1 0 I'm eidelweiss member from Inj3ct0r Team 1 1 ######################################## 0 0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1 Software Link: www.anantasoft.com Download: http://www.anantasoft.com/index.php?Gazelle%20CMS/Download Author: eidelweiss Contact: g1xsystem[at]windowslive.com Special Thank`s To: iwe a.k.a KirD , PKI a.k.a Andri klaten, m4rc0, and YOU !!!!! ================================================================ This vulnerability isssue can be exploited or use by attacker to upload arbitary shell script to gain access, or data. 1. You Need To Register Your self 2. When your account active (registed) after activate your account by clicking on following link in your mail, then login with type your user name and password . 3. after you login successful click "To admin panel" or "To user panel" and/or you will be direct to http://sample.site/ananta_path/admin or http://sample.site/ananta-path/user.php 4. Then go to or copy and paste this link: "/admin/editor/filemanager/frmupload.html" // (without quote) ex: http://sample.site/admin/editor/filemanager/frmupload.html 5. Upload your script backdoor shell there 6. If success or lucky your backdoor shell can be check or will be available here: http://sample.site/admin/editor/backdoorshellfile.extention (Ananta_Gazelle1.0/admin/editor/filemanager/connectors/php/config.php //line 27) or http://sample.site/user/backdoorshellfile.extention (Ananta_Gazelle1.0/admin/editor/filemanager/connectors/php/config.php //line 27) NOTE: Edit your backdoor shell by adding GIF or JPG source, so you can get the shell. =========================| -=[ E0F ]=- |============================

References:

http://eidelweiss-advisories.blogspot.com/2010/08/ananta-gazelle-cms-shell-upload.html


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2021, cxsecurity.com

 

Back to Top