Seditio CMS Remote File Upload Vulnerability

vendor:

Seditio and Ldu CMS

by:

A.D.T

7.5

CVSS

HIGH

Remote File Upload

CWE

Product Name: Seditio and Ldu CMS

Affected Version From: All Versions

Affected Version To: All Versions

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested: Unknown

2007

Seditio CMS Remote File Upload Vulnerability

This exploit allows an attacker to upload malicious files to the Seditio and Ldu CMS websites. The attacker needs to register on the victim's website and then upload the evil script through the 'pfs.php' page. The evil script can be in the form of a .php.gif, .php.jpg, or .php.png file.

Mitigation:

Unknown

Source

Exploit-DB raw data:

# Seditio CMS Remote File Upload Vulnerability

# ReSearcher : A.D.T

# Script : Seditio and Ldu Cms

# Version : All Versions

# Script HomePage : http://neocrome.net/

# Dork : "powered by seditio" or "powered by ldu"

# Risk : Very High!

# Usage : Firstly, you register the victim web site. After, go to "pfs.php" and upload your evil script!

# [+] Your Evil Script : evilscriptname.php.gif or evilscriptname.php.jpg or evilscriptname.php.png

# Contact : a.d.t-gizliadres@hotmail.com

# HomePage : http://err0rgroup.org/    

# We Are : A.D.T | LaqNéS | KeyStr0ke |Pcq0 | Dümenci | SaLuR | Z@rih | 0ssi3 | Sanal-Tehlike | Lnt

# ...and thanks str0ke

# milw0rm.com [2007-07-27]