AvailScript Article Script - Arbitrary File Upload

Author: S.W.A.T.
type: webapps
platform: php
port: 
date_added: 2008-12-13  
date_updated:   
verified: 1  
codes: OSVDB-56861;CVE-2008-6900  
tags:   
aliases:   
screenshot_url:   
application_url:   

raw file: 7456.txt  

[~] Availscript Article Script Remote File Upload Vulnerability
[~]
[~] ----------------------------------------------------------
[~] Discovered By: S.W.A.T.   svvateam@yahoo.com
[~]
[~] Home: www.batlagh.com
[~]
[~] Script Page: http://www.availscript.com/article_script.php
[~] -----------------------------------------------------------

Xpl:

1.First Register Into The Site ( link: www.site.com/[path]/signup.php )

2.Login With Your Email & Password

3.After That Go To "Add Pen/Author Name" ( link: www.site.com/[path]/memberarea/addpen.php )
& Write Your Author & Select Your Shell.php like: c99.php

4.Your Shell Will Be Appear In This Folder ( link: www.site.com/[path]/photos/ )

5.Your Shell Will Be Renamed With Random Text like: cc1bd-c99.php

6.Hack The Site ;)


Demo:

http://www.availscript.com/article_script/



[~] Special Thanks To:

Str0ke, All My Friends, Iranian Hackers & All Muslim

# milw0rm.com [2008-12-14]