Drupal comment-form Upload Dangerous File

2017.05.16
Risk: Medium
Local: No
Remote: Yes
CVE: N/A
CWE: N/A

# Exploit Title : Deface Drupal File With Tamper # Exploit Author : GU3LT03M # DORK : inurl:"/register?destination=node/" intext:"Allowed file types: png gif jpg" # # [+] File Location :https://127.0.0.1/sites/default/files/[path]/file name # # Tutorial See here http://ryangueltoem.blogspot.co.id/2017/05/deface-drupal-file-with-tamper.html ################################################################################# # # [+] Demo : #http://www.unitech.ac.pg/user/register?destination=node/717%23comment-form #http://alumni.pec.ac.in/user/register?destination=node/77 #http://anh-academy.org/member/register?destination=node/576%23comment-form # # # [+] File Location # # http://www.unitech.ac.pg/sites/default/files/filefield_paths/nitip.php.txt # ################################################################################# # # Step By Step : # # 1. Dorking inurl:"/register?destination=node/" intext:"Allowed file types: png gif jpg" # 2. Select one of the web # 3. Open Tamper Data # 4. Upload File .php.jpg # 5. Tamper becomes .php # 6. Right-click the file and open it in the new tab # ################################################################################# # # Tutorial See here http://ryangueltoem.blogspot.co.id/2017/05/deface-drupal-file-with-tamper.html # #################################################################################

References:

http://ryangueltoem.blogspot.co.id


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2018, cxsecurity.com

 

Back to Top