🤝 Privilege Escalation Vulnerability
Privilege Escalation Vulnerability - YouTube
================================================================================
| # Title : Bazaar | Social Listing Shopping Web PHP Template Privilege Escalation Vulnerability
| # Author : indoushka
| # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 66.0.2(32-bit)
| # Dork : "/ad-info.php?adObjID="
================================================================================
poc :
[+] Dorking İn Google Or Other Search Enggine.
[+] Create New User Account. Egypt Drinks | Egyptian Alcohol Market
[+] Create new stuff to Sell it 404 Not Found
[+] When you create new stuff they give you id reference : /sell-edit-stuff.php?adObjID=FUFtDfZEny
[+] Id reference = FUFtDfZEny
[+] Now select any other product's ID and replace it at the end of the variable.
[+] " /Sell-edit-stuff.php?adObjID= " Replace it FUFtDfZEny with iSTyt9gIoM
[+] 404 Not Found
Greetings to ============================================================
jericho Larry W. Cashdollar brutelogic* hyp3rlinx* 9aylas shadow_00715 LiquidWorm*
======================================================================
Privilege Escalation Vulnerability - YouTube
================================================================================
| # Title : Bazaar | Social Listing Shopping Web PHP Template Privilege Escalation Vulnerability
| # Author : indoushka
| # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 66.0.2(32-bit)
| # Dork : "/ad-info.php?adObjID="
================================================================================
poc :
[+] Dorking İn Google Or Other Search Enggine.
[+] Create New User Account. Egypt Drinks | Egyptian Alcohol Market
[+] Create new stuff to Sell it 404 Not Found
[+] When you create new stuff they give you id reference : /sell-edit-stuff.php?adObjID=FUFtDfZEny
[+] Id reference = FUFtDfZEny
[+] Now select any other product's ID and replace it at the end of the variable.
[+] " /Sell-edit-stuff.php?adObjID= " Replace it FUFtDfZEny with iSTyt9gIoM
[+] 404 Not Found
Greetings to ============================================================
jericho Larry W. Cashdollar brutelogic* hyp3rlinx* 9aylas shadow_00715 LiquidWorm*
======================================================================

