webgrind 1.0 – ‘file’ Local File Inclusion

• Exploit Database
• 33 阅读

• 作者： LiquidWorm
  日期： 2012-02-25
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/18523/

• webgrind 1.0 (file param) Local File Inclusion Vulnerability
  
  
  Vendor: Joakim Nygard and Jacob Oettinger
  Product web page: http://code.google.com/p/webgrind
  Affected version: 1.0 (v1.02 in trunk on github)
  
  Summary: Webgrind is an Xdebug profiling web frontend in PHP5.
  
  Desc: webgrind suffers from a file inlcusion vulnerability (LFI)
  when input passed thru the 'file' parameter to index.php is not
  properly verified before being used to include files. This can be
  exploited to include files from local resources with directory
  traversal attacks and URL encoded NULL bytes.
  
  ----------------------------------------
  /index.php:
  -----------
  
  122: case 'fileviewer':
  123: $file = get('file');
  124: $line = get('line');
  
  ----------------------------------------
  
  Tested on: Microsoft Windows XP Professional SP3 (EN)
   Apache 2.2.21
   PHP 5.3.9
   MySQL 5.5.20
  
  
  Vulnerability discovered by Michael Meyer
  michael.meyer greenbone net
  
  
  Vendor status:
  
  [22.02.2012] Vulnerability discovered.
  [22.02.2012] Vendor notified.
  [24.02.2012] No response from the vendor.
  [25.02.2012] Public security advisory released.
  
  
  Advisory ID: ZSL-2012-5075
  Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5075.php
  
  Vendor: http://code.google.com/p/webgrind/issues/detail?id=66
  
  
  22.02.2012
  
  ---
  
  
   http://<host>/webgrind/index.php?file=/etc/passwd&op=fileviewer
   http://<host>/webgrind/index.php?file=/boot.ini&op=fileviewer