Exploit AvailScript Classmate Script - Arbitrary File Upload

[Exploiter]

EDB-ID

7457

Проверка EDB

1. Пройдено

Автор

S.W.A.T.

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

N/A

Дата публикации

2008-12-14

[~] Availscript Classmate Script Remote File Upload Vulnerability
[~]
[~] ----------------------------------------------------------
[~] Discovered By: S.W.A.T.   [email protected]
[~]
[~] Home: www.batlagh.com
[~]
[~] Script Page: http://www.availscript.com/classmate_script.php
[~] -----------------------------------------------------------

Xpl:

1.First Register Into The Site ( link: www.site.com/[path]/register.php )

2.In Register Section Select Your phpshell like: c99.php

3.In "Latest Members" Section Right Click On Blank Line & Then Choose Properties

4.Copy The Link Of Your Shell Like: http://www.availscript.com/classmate/memberspics/saeid-61609-c99.php

5.Your Shell Will Be Renamed With Your Name & Random ID like: saeid-61609-c99.php

6.Hack The Site ;)


Demo:

http://www.availscript.com/classmate/



[~] Special Thanks To:

Str0ke, All My Friends, Iranian Hackers & All Muslim

# milw0rm.com [2008-12-14]