[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : PhpLinkExchange v1.02 - XSS/Upload Vulerability
# Published : 2009-12-16
# Author : Stink'
# Previous Title : D-Tendencia Bt 2008 SQL Injection Vulnerability
# Next Title : freekot (auth bypass) SQL Injection Vulnerability
#############################
PhpLinkExchange v1.02 - XSS/Upload Vulerability
Discovered by : Stink'
Date : 2009-12-16
Dork : "PhpLinkExchange v1.02"
Website Publisher : http://www.idevspot.com/PhpLinkExchange.php
#############################
-- [XSS in URL] --
http://server/links/PhpLinkExchange/index.php?page=home&catid=[XSS]
-- [XSS in form] --
http://server/links/PhpLinkExchange/index.php?page=tellafriend
The XSS is in "Your Email Adress"
-- [Upload Vulnerability] --
http://server/links/library/add_images.php
After your shell uploaded, go here :
http://server/links/appimage/ and search your shell :)