Freelancers Marketplace Script Upload Vulnerability

vendor:

Freelancers Marketplace Script

by:

Sid3^effects aKa HaRi

7,5

CVSS

HIGH

Persistent Upload Vulnerability

N/A

CWE

Product Name: Freelancers Marketplace Script

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2010

Freelancers Marketplace Script Upload Vulnerability

Freelancers Marketplace Script is an Extensive and Powerful script written in PHP and Ajax to launch your own Freelancers website. An attacker can insert their evil scripts or shells in the 'describe' section of the post_project.php page and then check the main sites for the projects to find the script or shell.

Mitigation:

Ensure that all user input is properly sanitized and validated before being used in any application.

Source

Exploit-DB raw data:

Name : Freelancers Marketplace Script Upload Vulnerability
Date : july 17,2010
Critical Level 	: HIGH
vendor URL :http://www.guruscript.com/
google dork:Powered by Guruscript.com
Author : Sid3^effects aKa HaRi 
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_,SeeMe,RoadKiller 
greetz to :www.topsecure.net ,All ICW members and my friends :) luv y0 guyz 

NOtice : The persistent Xss and upload vuln is in other 2 versions also namely Plus,Gold scripts 
#######################################################################################################
Description:
Freelancers Marketplace Script is an Extensive and Powerful script written in PHP and Ajax to launch your own Freelancers website. Create your own global talent search marketplace with this script. Service seekers can post their requirements through this script and the service providers can place their bids for doing the job. Highly configurable features and fully customizable colors, styles, fonts and graphics make this script very very special.
#######################################################################################################
Xploit: Persistent Upload Vulnerability

Step 1 : Register as a user.

Step 2 : Now go and post your project 
DEMO URL :http://site.com/post_project.php

Step 3 : The attacker can insert thier evil scripts or shells  in the "describe" section.

Step 4 : Now check the main sites for the projects and you may find your script or shell  ;) 
DEMO URL : http://site.com/all_projects.php
#######################################################################################################
# 0day no more 
# Sid3^effects