Interspire Shopping Cart Full Path Disclosure

=============================================
Interspire Shopping Cart Full Path Disclosure
=============================================

# Exploit Title: Interspire Shopping Cart Full Path Disclosure
# Date: 13-12-2009
# Author: Mr.aFiR
# Software Link: http://www.interspire.com/
# Version: N/A
# Tested on: GNU/LINUX
# CVE : N/A
# Code : N/A
#####################################################################
#####################################################################
##                        * What's it ?                            ##
##                      -----------------                          ##
## ~  This is Shopping Cart script, sometimes we find us on a      ##
##    server where we have a shopping cart script as this.         ##
##    And we dont know the directory of infected website (ISC)     ##
##    and we cant find it by using our uploaded shell.             ##
##    This Vulnerability is comming to show you the directory      ##
##    of website(with username on system sometimes).               ##
## ~ Infected File : [xml.php]                                     ##
##   // Get the XML request data                                   ##
##  if(isset($_REQUEST["xml"])) {                              ##
##      $request = $_REQUEST["xml"];                       ##
##  }                                                          ##
##  else {                                                     ##
##      $request = file_get_contents('php://input');       ##
##  }                                                          ##
##                                                                 ##
##  // Instantiate the API which also takes care of validation ##
##  $api = new API($request);                                  ##
##                                                                 ##
##  // Run the request                                         ##
##  $api->RunRequest();                                        ##
##                                                                 ##
## ~ When we're visiting "xml.php" without the request "?xml=*"    ##
##   the request is gonna be good with out any error.              ##
##   But if we sent a request with the "?xml=*" ,                  ##
##   that will make an PHP error. Error location :                 ##
##   [includes/classes/class.api.php] on line 91:                  ##
##      // Store a refernece to the XML object                     ##
##       $this->_xml = new SimpleXMLElement($this->_request);      ##
## ~ This is Only a Full Path Diclosure Vunlerability !            ##
##  ------------------------------------------------------------   ##
##      Thanks & Greatz To≤ All My Friends (Dr.Crypter, Love511,   ##
##       Dr.BoB-Hacker, Mr.LASSiSSi, ...) & All Muslim HaCkerz.    ##
#####################################################################



#  0day.today [2018-04-14]  #