Nova CMS Directory Traversal

[The_Arhitect]

Nova CMS Directory Traversal

# 
# Title     : Nova CMS Directory Travel
# Author    : Red Security TEAM
# Date      : 21/01/2012
# Download  : http://www.nova-cms.com/uploads/files/novacms.zip
# Tested On : CentOS
# Dork      : Copyright ©2005-2011 by Nova CMS.
# Contact   : Info [ 4t ] RedSecurity [ d0t ] COM
# Home      : http://RedSecurity.COM
#
# Exploit   :
# 
# 1. Register
# 2. Go to forum and click on "NEW TOPIC"
# 3. In the above tab in editor click on last picture "Attach File"
# 4. Start Live HTTP headers
# 5. Add a new allowed file
# 6. Find dir=uploads%2Fforum%2Fdata-YourUsername2F&options=true&ajax=true and click on Reply on Live HTTP headers
# 7. Change to dir=uploads%2F , dir=uploads%2Fbackup%2F
# 8. You can't back to directory before uploads directory but you can see all directory in uploads example another users files and uploads/backup/ 
#

Sursa: Nova CMS Directory Traversal