Monday, 31 August 2015

Remote Code Execution 0day

Hi Friends,

Many of you already know that people try to do the things which provide them some fruits. likewise Carders trying to Exploit Shopping carts for getting into the transaction system in order to snatch people's money. Magento is a famous eCommerce CMS. this is the main target also as many of shopping sites are based on this CMS.

Here is a Recent exploit "obviously not found by me but code is mine." Which allows an attacker to change Username and Password of a site remotely. this is due to remote code Execution.

Exploit Code



and here are Results i got from Execution of the Script.



Bingoo !!


P.S: No any sites were harmed and Affected ones are reported already.


References:

  • http://blog.checkpoint.com/2015/04/20/analyzing-magento-vulnerability/


Magento Shopping Cart 0day Exploit

  • Uploaded by: Unknown
  • Views:
  • Share

    7 comments:

    1. http://i.imgur.com/6xYxqsc.png why ?

      ReplyDelete
    2. Thank you for sharing excellent information. Your website is very cool. Fully useful your blog post... Online Shopping Website In India

      ReplyDelete
    3. CLASSIC CYBER HACKS
      How well are you prepared for a Cyber incident or Breach?, Is your Data safe?
      Strengthen your Cybersecurity stance by contacting CLASSIC CYBER NOTCH @ GMAIL DOT COM for a Perfect, Unique, Classic and Professional Job in Securing your Network against all sort of breaches and from scammers as well.
      For we are Specially equipped with the Best hands to getting your Cyber Hack needs met as your jobs will be handled with utmost professionalism.

      We do All type of cyber Jobs such as:
      ☑ TRACKING of GPS location, cars, Computers, Phones (Apple, windows and Android), e.t.c.
      We also Track
      E-MAIL account,(G-mail, Yahoo mail, AOL, Proton mail, etc.)
      SOCIAL MEDIA account, (Facebook, Twitter, Skype, Whatsapp, e.t.c.)

      ☑ RECOVERY of Passwords for E-mail address, Phones, Computers, Social media Accounts, Documents e.t.c

      ☑ INSTALLATION of Spy ware so as to spy into someone else's computer, phone or E-mail address and also Installation of Spy ware software on your individual O.S so as to detect intrusion of any type.
      We also Create and Install VIRUS into any desired computer gadget.

      ☑ CRACKING Websites, any desired gadget it computers or phones, CCTV Survelance camera, Data base (of both Private and Govt organization, such as Schools, Hospitals, Court houses, The FBI, NSA) e.t.c....

      NOTE:
      Other Jobs we do are:
      ☑ We provide Private Investigator service
      ☑ Clearing Criminal records of diverse type
      ☑ Binary Options fraud Recovery
      ☑ Bitcoin Mining
      ☑ Issuing of Blank ATM cards
      ☑ And many more... etc.

      We assure you that your Job will be attended to with care and efficiency as it will be handled by the Best professional hands in Cyber literacy.
      We also have a forum where you can get yourself equipped with Advanced hacking Knowledge..

      CLASSIC CYBER HACKS gives you the Best service in the Hacking world as our Success rate is Top Notch

      Be sure to 📱 💻 us via E-mail @

      Classic cyber notch at gmail dot com

      any time, any day to get the Best Professional hands involved in putting a smile on your face.
      We're Classic Hacks

      Signed,
      Collins .A.

      ReplyDelete

     
    Copyright © HACK | Designed by Muhammad Adeel | Founder UrduSecurity