ScriptsFeed (SF) Auto Classifieds Software Remote File Upload

vendor:

Auto Classifieds Software

by:

ZoRLu

7.5

CVSS

HIGH

Remote File Upload

434

CWE

Product Name: Auto Classifieds Software

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

ScriptsFeed (SF) Auto Classifieds Software Remote File Upload

A vulnerability in ScriptsFeed (SF) Auto Classifieds Software allows an attacker to upload a malicious file to the server. An attacker can exploit this vulnerability by registering an account on the application, logging in, and then uploading a malicious file to the server. The malicious file can then be accessed via the URL http://localhost/script/cars_images/[id]_logo_your_shell.php

Mitigation:

Ensure that the application is configured to only allow the upload of files with specific extensions and that the application is configured to only allow the upload of files with specific sizes.

Source

Exploit-DB raw data:

[~] ScriptsFeed (SF) Auto Classifieds Software Remote File Upload
[~]
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu
[~]
[~] Date: 13.11.2008
[~]
[~] Home: www.z0rlu.blogspot.com
[~]
[~] contact: trt-turk@hotmail.com
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~]
[~] my bug number now: 39
[~]
[~] my target bug number: 100
[~]
[~] -----------------------------------------------------------


Exploit:

http://localhost/script/cars_images/[id]_logo_your_shell.php

you register to site 

register: http://localhost/script/register.php

after you login to site

login: http://localhost/script/login.php

more after you go profile edit

profile: http://localhost/script/profile.php

and you upload your_shell.php right click to your logo and select properties copy link

paste your explorer go your_shell.php

your_shell.php path:

http://localhost/script/cars_images/[id]_logo_your_shell.php



rfu for demo:

user: zorlu

passwd: zorlu1

shell path:

http://www.scriptsfeed.com/demos/auto_classifieds_1/cars_images/1226597431_logo_c.php


[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & all Muslim HaCkeRs
[~]
[~] yildirimordulari.org  &  darkc0de.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2008-11-13]