Jevonweb Guestbook Remote Admin Access Exploit

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : Jevonweb Guestbook Remote Admin Access Exploit
# Published : 2009-12-25
# Author : Sora
# Previous Title : Ads Electronic Al-System Cross Site Scripting Vulnerability
# Next Title : Simple PHP Guestbook Remote Admin Access Exploit

# Vendor: http://www.jevonweb.f2s.com/
# Version: 1.0
# Tested on: Windows and Linux
---------------------------------------
> Jevonweb Guestbook Remote Admin Access Exploit
> Author: Sora
> Contact: vhr95zw@hotmail.com
> Google Dork: "Jevonweb Guestbook" "http://www.jevonweb.f2s.com/" inurl:/cp/Scripts/PHP/Guestbook/config.php

Description:
Jevonweb Guestbook suffers a remote admin access exploit in setup.php.

Solution:
Add setup.php to the webhost's .htaccess file.

# Code: http://www.site.com/cp/Scripts/PHP/Guestbook/read.txt
# Greetz: Bw0mp, Popc0rn, Xermes, T3eS, Timeb0mb, [H]aruhiSuzumiya, and Revelation!