rapid7/metasploit-framework — pull request #771 by wchen-r7 (2012-09-06 23:33:48+00:00)
Title: Add OSVDB-83767: SFlog Upload Exec Module

This module exploits multiiple flaws in SFlog!. By default, the CMS has a default admin cred of "admin:secret", which can be abused to access admin features such as blog management. Through the management interface, we can upload a backdoor that's accessible by any remote user, and then we gain code execution.