Doubt in MySQL Quick Admin <= 1.5.5 (COOKIE) LFI

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1052432 漏洞类型
发布时间 2008-10-18 更新时间 2008-10-18
CVE编号 N/A CNNVD-ID N/A
漏洞平台 N/A CVSS评分 N/A
|漏洞来源
https://cxsecurity.com/issue/WLB-2008100047
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
 Greetings All,


I am trying to reproduce the issue, but php is reporting some error:
like fail to open lang/../../../../../../../../../../etc/passwd%00; path=//lang.php.

vulnerable code is:

include("lang/".$_SESSION['language']."/lang.php");

exploit is: ../../../../../../../../../../etc/passwd%00; path=/ as the value of vulnerable paramter.

exploit link is:http://milw0rm.com/exploits/6641

After observing this error i thought there must some issue with the application, so created a vulnerable php program whose details are:


<?php

include("lang/".$_GET[filename]."/lang.php");

?>


Then i send a GET a request:

GET /vulnerable php?filename=lang/../../../../../../../../../../etc/passwd%00; path=/

still, i am observing same error.

This is happening because inside include function, there is an additon of  /lang.php after the vulnerable parameter value in both case.

I am not able to understand how the author manage to view the contents of /etc/passwd by this method.

please help me out.

Thanks in advance.