getaphpsite Auto Dealers - Arbitrary File Upload

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1056975 漏洞类型
发布时间 2008-11-22 更新时间 2008-11-22
CVE编号 N/A CNNVD-ID N/A
漏洞平台 PHP CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/7189
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
[~] geta php cardealers Remote File upload
[~]
[~]----------------------------------------------------------
[~] Discovered By: ZoRLu  msn: trt-turk@hotmail.com
[~]
[~] Date: 22.11.2008
[~]
[~] Home: www.z0rlu.blogspot.com
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~] -----------------------------------------------------------

first register to site 

login to site and edit your profile

upload your_shell.php 

your_shell.php path:

localhost/script/re_images/[ID]_logo_your_shell.php

example for demo:

login: http://www.getaphpsite.com/demos/cardealers/login.php

user: zorlu

passwd: zorlu1

shell:

http://www.getaphpsite.com/demos/cardealers/re_images/1227370217_logo_c.php

[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & all Muslim HaCkeRs
[~]
[~] yildirimordulari.org  &  darkc0de.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2008-11-22]