| Sm0ke |
| Moderator |
 |
|
| Joined: Nov 25, 2006 |
| Posts: 141 |
| Location: Finland |
|
|
 |
|
 |
|
| Code: | ##############################################################################################
#INFO:
#Program Title ################################################################################
#e107 - Arbitrary File Upload
#
#Description ##################################################################################
#"e107 is a content management system written in PHP and using the popular open source MySQL
#database system for content storage. It's completely free, totally customisable and in
#constant development" - e107.org
#
#Script Download ##############################################################################
#http://e107.org/edownload.php
#
#Original Advisory ############################################################################
#http://www.g00ns-forum.net/showthread.php?t=9388
#
#Vuln #########################################################################################
#vuln discovered by clorox
#shoutz: z3r0, milf, blackhill, godxcel, murderskillz, kirby, katalyst, SyNiCaL, OD, pr0be, rezen, str0ke,
#fish, rey, canuck, ,vipsta, c0ma, sick, trin, a59, seven, fury, <S>, Bernard, and everyone else at g00ns.net
#
#Details ######################################################################################
#note: e107 is only vulnerable if it allows you to upload a photograph, avatars will not work.
#signup.php does not verify that a file submitted as an image is actually an image. it controls files uploaded
#only by the extension. files with a .php extension are blocked, but you can simply rename a php document to
#document.php.jpg and it passes the image verification and is uploaded. to get the path of the file you uploaded
#you view your profile, view the source of the page and search for the name of the file and it will be there with
#a few random numbers in it, and now all an attacker would have to do is simply call the evil script up and the
#server has been compromised.
#GoogleDork: "Please note: Any image uploaded to this server that is deemed inappropriate by the administrators will be deleted immediately."
#
################################################################################################ |
|
|
Discussions
Tools
Content
Info
Membership:
Latest: 
New Today: 0
New Yesterday: 0
Overall: 9144
People Online:
Visitors: 73
Members: 0
Total: 73
