<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7651.51">
<TITLE>logahead UNU edition 1.0 Remote upload file & code execution</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/plain format -->
<BR>
<P><FONT SIZE=2>-=[--------------------ADVISORY-------------------]=-<BR>
<BR>
logahead UNU edition 1.0 <BR>
<BR>
Author: CorryL [corryl80@gmail.com] <BR>
-=[-----------------------------------------------]=-<BR>
<BR>
<BR>
-=[+] Application: logahead UNU edition<BR>
-=[+] Version: 1.0<BR>
-=[+] Vendor's URL: <A HREF="http://typo.i24.cc/logahead/">http://typo.i24.cc/logahead/</A><BR>
-=[+] Platform: Windows\Linux\Unix<BR>
-=[+] Bug type: Remote Upload file & Code execution<BR>
-=[+] Exploitation: Remote<BR>
-=[-]<BR>
-=[+] Author: CorryL ~ corryl80[at]gmail[dot]com ~<BR>
-=[+] Reference: www.x0n3-h4ck.org<BR>
-=[+] Virtual Office: <A HREF="http://www.kasamba.com/CorryL">http://www.kasamba.com/CorryL</A><BR>
-=[+] Irc Chan: irc.darksin.net #x0n3-h4ck <BR>
-=[+] Special Thanks: Merry Christmas for All, Thanks for all #x0n3-h4ck member,<BR>
un saluto a tutti gli avolesi nel mondo.<BR>
<BR>
..::[ Descriprion ]::..<BR>
<BR>
You might already have heard of logahead - the ajaxified blogging engine using PHP4 and mySQL database by James from the UK.<BR>
The UNU edition is based on the logahead beta 1.0 code published under GNU/GPL license. While the original version sticks to the basic functions of a blog (mainly publishing posts and receiving comments), the UNU edition is more enchanted and offers a number of additional features.<BR>
<BR>
<BR>
..::[ Bug ]::..<BR>
<BR>
My give searches the form Widgets of this blog is results vulnerability, in fact<BR>
a remote attaker is able to upload also a file php, and to perform arbitrary commands<BR>
inside the server victim.<BR>
<BR>
..::[ Proof Of Concept ]::..<BR>
<BR>
<A HREF="http://www.server-victim/extras/plugins/widged/_widged.php?A=U&D=">http://www.server-victim/extras/plugins/widged/_widged.php?A=U&D=</A><BR>
<BR>
<BR>
..::[ Disclousure Timeline ]::..<BR>
<BR>
[25/12/2006] - Public disclousure<BR>
<BR>
<BR>
**************<BR>
Registrati ad Alice Basic e scarica Alice Messenger,<BR>
il nuovo instant messenger che ti fa chattare GRATIS con i tuoi amici!<BR>
Per maggiori informazioni vai su:<BR>
<A HREF="http://adsl.alice.it/servizi/alicebasic.html?pmk=psmail_foot01">http://adsl.alice.it/servizi/alicebasic.html?pmk=psmail_foot01</A></FONT>
</P>
</BODY>
</HTML>