joomla FreiChat upload shell

2012.09.30

Credit: BHG Security Center

Risk: High

Local: No

Remote: Yes

CVE: N/A

CWE: N/A

Dork: inurl:/freichat/client/

##################################################
joomla FreiChat upload shell
##################################################

 # Exploit Title :joomla FreiChat upload shell
 # Google Dork: inurl:/freichat/client/  
 #Exploit : http://site.com/path/freichat/client/plugins/upload/html.php  
 #Author: BHG Security Center
 # Home: http://cc.black-hg.org - http://greyh4t.com/cc/
 # Tested on: [linux+apache]
 # Finder(s):Siavash (morghabi_s@yahoo.com)
 # Examle:
http://www.royXXXes.fr/freichat/client/plugins/upload/html.php
http://www.impaXXming.us/freichat/client/plugins/upload/html.php
http://central-cXXhofchrist.com/installed/directory/freichat/client/plugins/html.php
http://bcua.wXXo.at/freichat/client/plugins/upload/html.php
http://www.ilovXXXon.com/freichat/client/plugins/upload/upload/html.php  
##################################################
[-] Disclosure timeline:

[04/08/2011] - Vulnerabilities discovered
[14/10/2011] - Others vulnerabilities discovered
[15/10/2011] - Issues reported to http://black-hg.org
[04/09/2012] - Public disclosure

# Greets To :
Net.Edit0r ~ A.Cr0x ~ 3H34N ~ G3n3Rall ~ l4tr0d3ctism ~ NoL1m1t

~ Mr.XHat THANKS TO ALL Iranian HackerZ ./Persian Gulf

======[End]=======

References:

http://site.com/path/freichat/client/plugins/upload/html.php

http://cc.black-hg.org

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

joomla FreiChat upload shell

Dork: inurl:/freichat/client/

References:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.