Exploit LinPHA 0.9.x/1.0 - 'sec_stage_install.php' Local File Inclusion

[Exploiter]

EDB-ID

27194

Проверка EDB

1. Пройдено

Автор

RGOD

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

cve-2006-0713

Дата публикации

2006-02-11

source: https://www.securityfocus.com/bid/16592/info
  
LinPHA is prone to multiple local file-inclusion and PHP code-injection vulnerabilities. The local file-inclusion issues are due to insecure use of the 'include_once()' PHP function in multiple scripts. The PHP code-injection vulnerabilities are due to insufficient input validation of data that is saved to log files.
  
This will permit an attacker to influence the include path to point to files that are hosted on the computer that is running the affected application. In this manner, files that are readable by the webserver process may be output to the attacker.
  
Attackers may also inject arbitrary PHP code into the log files and cause it to be interpreted. This would occur in the context of the server hosting the application.

http://www.example.com/[path]/install/sec_stage_install.php?whatlang=1&language=/../../../../../../../test
http://[target]/[path]/install/sec_stage_install.php?language=/../../../../../../../test