API tools faq
paste
KingSkrupellos

Companhia da Midia Brasil Unauthorized File Insertion

KingSkrupellos
May 21st, 2019
59
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 2.05 KB | None | 0 0
raw download clone embed print report
  1. ####################################################################
  2.  
  3. # Exploit Title : Companhia da Midia Brasil Unauthorized File Insertion
  4. # Author [ Discovered By ] : KingSkrupellos
  5. # Team : Cyberizm Digital Security Army
  6. # Date : 21/05/2019
  7. # Vendor Homepage : companhiadamidia.com.br
  8. # Tested On : Windows and Linux
  9. # Category : WebApps
  10. # Exploit Risk : Medium
  11. # Vulnerability Type : CWE-264 [ Permissions, Privileges, and Access Controls ]
  12. # PacketStormSecurity : packetstormsecurity.com/files/authors/13968
  13. # CXSecurity : cxsecurity.com/author/KingSkrupellos/1/
  14. # Exploit4Arab : exploit4arab.org/author/351/KingSkrupellos
  15.  
  16. ####################################################################
  17.  
  18. # Description About Software :
  19. *****************************
  20. Companhiada Midia is Web Design Company in Brasil.
  21.  
  22. ####################################################################
  23.  
  24. # Impact :
  25. ***********
  26. Companhia da Midia Brasil is prone to a vulnerability that lets attackers
  27. upload arbitrary files because it fails to adequately sanitize user-supplied input.
  28.  
  29. An attacker can exploit this vulnerability to upload arbitrary code and execute
  30. it in the context of the webserver process. This may facilitate unauthorized access
  31. or privilege escalation; other attacks are also possible.
  32.  
  33. ####################################################################
  34.  
  35. # Arbitrary File Upload / Unauthorized File Insert Exploit :
  36. **************************************************
  37. /fckeditor/editor/filemanager/connectors/uploadtest.html
  38.  
  39. Directory File Path :
  40. ******************
  41. /userfiles/conteudos/[YOURFILENAME].txt .jpg .gif .png
  42.  
  43. ####################################################################
  44.  
  45. # Example Vulnerable Sites :
  46. ************************
  47. [+] araujoadvocacia.com.br/fckeditor/editor/filemanager/connectors/uploadtest.html
  48.  
  49. ####################################################################
  50.  
  51. # Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team
  52.  
  53. ####################################################################
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!