tailieunhanh - Hacker Professional Ebook part 377

Tham khảo tài liệu 'hacker professional ebook part 377', công nghệ thông tin, kỹ thuật lập trình phục vụ nhu cầu học tập, nghiên cứu và làm việc hiệu quả | echo Exploit failed. r n micimacko HCE GuestBook Remote Command Execution Xploit Code http scriptpath GB_PATH http con shell black_hat_cr HCE Hosting Controller Hotfix Multi Vuln. Trich Hosting Controller Hotfix Multi Vuln. SQL_Injection Command Injection KAPDA 59 - Hosting Controller Hotfix Vendor Hosting Controller Vendor URL Solution Hotfix Found Date 7 1 2006 Release Date 10 10 2006 Discussion UnAuthenticated user can 1- delete every sites virtual directory on hc sites 2- make forum virtual directory with the desire name for everysites on hc 3- disable all hc forums by SQL Injection 4- enable all hc forums by SQL Injection Bugs are available in and in forum directory. Exploit or POC 1- unAuthenticated user can delete every sites virtual directory on hc sites by forum forum HCSpecific action disableforum WSiteName tes tsite. com VDirName test F orumID 1 2- unAuthenticated user can make forum virtual directory with the desire name for everysites on hc by forum forum HCSpecific action enableforum WSiteName tests VDirName test ForumID 3- unAuthenticated user can disable all hc forums by SQL_Injection forum HCSpecific DisableF orum. asp action disableforum F orumID 1 or 1 1 4- unAuthenticated user can enable all hc forums by SQL_Injection forum HCSpecific EnableF action enableforum F orumID 1 or 1 1 Credit Soroush Dalili of Kapda and GSG IRSDL 4t kapda d0t ir Kapda - Security Science Researchers Insitute http GSG - Grayhatz security group http By Pi3cH On 16 Oct 2006 Navaro HCE Hosting Controller Hotfix Privilege Escalation Vulnerability Title An attacker can gain reseller privileges and after that can gain admin privileges Version Hotfix Developer url Solution Update to Hotfix Discover date 2005 Summer Report date to hc company .